PT-2026-65087

CVE-2026-59239

Published

2026-07-27

Updated

2026-07-27

Description by

CVSS 4.0

8.6

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Roskus Prospero Flow CRM versions prior to 5.4.4

Description The email module contains a stored cross-site scripting issue. A remote, authenticated user with low privileges can execute arbitrary JavaScript in the browser of another user, including administrators, by storing a malicious payload in an email body. This occurs because the email body is persisted without sanitization and rendered unescaped using {!! $email->body !!} when the recipient opens the message, which can lead to session compromise and account takeover.

Recommendations Update Roskus Prospero Flow CRM to version 5.4.4 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Gustavo Novaro

Robert Mihaila

Secur0 Cna

Vendors

Affected products

Weakness enumeration