EUVD-2026-49389
GHSA-wpjv-rrg6-52x9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (4daa8cea-433a-44bd-9456-53b127fc289a) · only source for this CVE.
CVSS VectorVendor: 4daa8cea-433a-44bd-9456-53b127fc289a
Lifecycle Timeline
4DescriptionCVE.org
Stored Cross-site Scripting (CWE-79) in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute arbitrary JavaScript in another user's browser, including administrators, leading to session compromise and account takeover, via a payload stored in an email body that is persisted without sanitization and rendered unescaped with {!! $email->body !!} when the recipient opens the message.
AnalysisAI
Stored cross-site scripting in Prospero Flow CRM before 5.4.4 allows low-privileged authenticated users to inject JavaScript into email bodies that execute when viewed by administrators, leading to session hijacking and account takeover. The vulnerability stems from unsanitized email content rendered unescaped via {!! ... !!}. A patch is available and no public exploit or active exploitation has been identified.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today