agentprime: roskus-prospero-flow-crmEvery new CVE for roskus-prospero-flow-crm.https://agentprime.io/CVE-2026-114519: Missing authorization in the Prospero Flow CRM user API allows a basic role user to read and delete other accountshttps://agentprime.io/advisories/CVE-2026-114519/https://agentprime.io/advisories/CVE-2026-114519/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 22 Oct 2026 19:13:31 GMTCVECVE-2026-82911: CSRF in Prospero Flow CRM order confirmation allows unauthorized order state changeshttps://agentprime.io/advisories/CVE-2026-82911/https://agentprime.io/advisories/CVE-2026-82911/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 04 Sep 2026 15:33:44 GMTCVECVE-2026-81931: Unrestricted upload of file with dangerous type in Prospero Flow CRM product photo allows stored cross-site scriptinghttps://agentprime.io/advisories/CVE-2026-81931/https://agentprime.io/advisories/CVE-2026-81931/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 27 Aug 2026 19:33:27 GMTCVECVE-2026-78365: IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modificationhttps://agentprime.io/advisories/CVE-2026-78365/https://agentprime.io/advisories/CVE-2026-78365/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 24 Aug 2026 12:49:36 GMTCVEcriticalCVE-2026-78337: Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVGhttps://agentprime.io/advisories/CVE-2026-78337/https://agentprime.io/advisories/CVE-2026-78337/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 24 Aug 2026 11:01:30 GMTCVECVE-2026-77780: Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiershttps://agentprime.io/advisories/CVE-2026-77780/https://agentprime.io/advisories/CVE-2026-77780/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 21 Aug 2026 12:12:59 GMTCVECVE-2026-77759: IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial recordshttps://agentprime.io/advisories/CVE-2026-77759/https://agentprime.io/advisories/CVE-2026-77759/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 21 Aug 2026 11:29:43 GMTCVECVE-2026-19871: Use of hard-coded credentials in Prospero Flow CRM employee onboardinghttps://agentprime.io/advisories/CVE-2026-19871/https://agentprime.io/advisories/CVE-2026-19871/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 14 Aug 2026 14:00:55 GMTCVEcriticalCVE-2026-19870: IDOR in Prospero Flow CRM allows cross-tenant payroll disclosure and creationhttps://agentprime.io/advisories/CVE-2026-19870/https://agentprime.io/advisories/CVE-2026-19870/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 14 Aug 2026 12:08:30 GMTCVECVE-2026-19734: IDOR in Prospero Flow CRM allows cross-tenant product disclosure and hijackinghttps://agentprime.io/advisories/CVE-2026-19734/https://agentprime.io/advisories/CVE-2026-19734/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 13 Aug 2026 14:04:55 GMTCVECVE-2026-19539: IDOR in Prospero Flow CRM allows cross-tenant ticket read, hijacking, and deletionhttps://agentprime.io/advisories/CVE-2026-19539/https://agentprime.io/advisories/CVE-2026-19539/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 11 Aug 2026 13:54:05 GMTCVECVE-2026-19433: Authorization Bypass Through User-Controlled Key in Prospero Flow CRM contact save and vCard exporthttps://agentprime.io/advisories/CVE-2026-19433/https://agentprime.io/advisories/CVE-2026-19433/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 14:04:14 GMTCVECVE-2026-59233: Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalationhttps://agentprime.io/advisories/CVE-2026-59233/https://agentprime.io/advisories/CVE-2026-59233/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 12:14:40 GMTCVECVE-2026-59232: Stored Cross-site Scripting in Prospero Flow CRM lead name fieldhttps://agentprime.io/advisories/CVE-2026-59232/https://agentprime.io/advisories/CVE-2026-59232/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 31 Jul 2026 16:00:45 GMTCVECVE-2026-59240: IDOR in Prospero Flow CRM allows deletion of other users' notificationshttps://agentprime.io/advisories/CVE-2026-59240/https://agentprime.io/advisories/CVE-2026-59240/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 27 Jul 2026 21:37:33 GMTCVECVE-2026-59239: Stored XSS in Prospero Flow CRM email body allows administrator account takeoverhttps://agentprime.io/advisories/CVE-2026-59239/https://agentprime.io/advisories/CVE-2026-59239/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 27 Jul 2026 17:56:08 GMTCVECVE-2026-59237: IDOR in Prospero Flow CRM Order API allows cross-tenant read and modification of ordershttps://agentprime.io/advisories/CVE-2026-59237/https://agentprime.io/advisories/CVE-2026-59237/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 16 Jul 2026 14:35:46 GMTCVECVE-2026-59236: Authorization bypass in Prospero Flow CRM Excel import allows cross-tenant record injectionhttps://agentprime.io/advisories/CVE-2026-59236/https://agentprime.io/advisories/CVE-2026-59236/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 15 Jul 2026 11:09:38 GMTCVECVE-2026-59235: Missing authorization in Prospero Flow CRM allows low-privileged users to read all bank accountshttps://agentprime.io/advisories/CVE-2026-59235/https://agentprime.io/advisories/CVE-2026-59235/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 15 Jul 2026 10:38:20 GMTCVECVE-2026-59234: Authorization Bypass Through User-Controlled Key in Prospero Flow CRM calendar event deletionhttps://agentprime.io/advisories/CVE-2026-59234/https://agentprime.io/advisories/CVE-2026-59234/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 03 Jul 2026 12:47:38 GMTCVE