CVE-2026-59232

Publié : 31 juillet 2026

Modifié : 31 juillet 2026

Description détaillée

Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows authenticated users holding the create or update lead permission to execute arbitrary JavaScript in the application origin via HTML markup stored in the lead name field, which the view renders through Blade's unescaped output directive and inside a JavaScript string literal in an onclick attribute.

Références et Patchs

https://github.com/Roskus/prospero-flow-crm/commit/8b2633ddb2178c2f79718efdfb906e051ba2f03c https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3 https://secur0.com/en/cna/cve-list/cve-2026-59232-stored-xss-in-prospero-flow-crm-lead-name-field

Dernières Vulnérabilités

CVE-2026-67822

Tenda W6-S 1.0.0.4(510) contains a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint. The function formwrlSSIDset uses sprintf to copy user-controlled 'GO' and 'index' parameters into a 64-byte stack buffer without length restriction, leading to stack overflow.

VOIR DÉTAILS

CVE-2026-58048

Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.

VOIR DÉTAILS

CVE-2026-58047

HTTP Smuggling in cPanel allows potential leak of credentials.

VOIR DÉTAILS