CVE-2026-59239CWE-79cross-site-scripting

CVE-2026-59239

published July 27, 2026

CVSS
8.6
EPSS
1%
Percentile
51.2
In the wild
Unconfirmed
What it is

Stored Cross-site Scripting (CWE-79) in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute arbitrary JavaScript in another user's browser, including administrators, leading to session compromise and account takeover, via a payload stored in an email body that is persisted without sanitization and rendered unescaped with {!! $email->body !!} when the recipient opens the message.

The record
Technical detail
CVSS
8.6 · NONE
CVSS v4.0
Not supplied
EPSS
0.00666 · 51.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-07-27T22:16Z
References (3)
https://github.com/Roskus/prospero-flow-crm/commit/32efcd5c395ee55119fb9aea502a9d06e4c5adb8 · 4daa8cea-433a-44bd-9456-53b127fc289ahttps://github.com/Roskus/prospero-flow-crm/releases · 4daa8cea-433a-44bd-9456-53b127fc289ahttps://secur0.com/en/cna/cve-list/cve-2026-59239-stored-xss-in-prospero-flow-crm-email-body-allows-administrator-account-takeover · 4daa8cea-433a-44bd-9456-53b127fc289a
EPSS history
Timeline
  • 27 JUL 17:56Z
    Stored XSS in Prospero Flow CRM email body allows administrator account takeover
    cvelistv5