Roskus vulnerabilities

Newest CVEs

• CVE-2026-114519

  Missing authorization in the Prospero Flow CRM user API allows a basic role user to read and delete other accounts

  Roskus · Prospero Flow CRM

  High8.6
• CVE-2026-82911

  CSRF in Prospero Flow CRM order confirmation allows unauthorized order state changes

  Roskus · Prospero Flow CRM

  Medium5.1
• CVE-2026-81931

  Unrestricted upload of file with dangerous type in Prospero Flow CRM product photo allows stored cross-site scripting

  Roskus · Prospero Flow CRM

  Medium4.8
• CVE-2026-78365

  IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification

  Roskus · Prospero Flow CRM

  Critical9.3
• CVE-2026-78337

  Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG

  Roskus · Prospero Flow CRM

  Medium4.8
• CVE-2026-77780

  Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers

  Roskus · Prospero Flow CRM

  Medium5.3
• CVE-2026-77759

  IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records

  Roskus · Prospero Flow CRM

  High8.7
• CVE-2026-19871

  Use of hard-coded credentials in Prospero Flow CRM employee onboarding

  Roskus · Prospero Flow CRM

  Critical9.3
• CVE-2026-19870

  IDOR in Prospero Flow CRM allows cross-tenant payroll disclosure and creation

  Roskus · Prospero Flow CRM

  High8.6
• CVE-2026-19734

  IDOR in Prospero Flow CRM allows cross-tenant product disclosure and hijacking

  Roskus · Prospero Flow CRM

  High8.6