Skip to content
Secur0
Solutions
AI Agent Security New Protect your AI agents Vulnerability Disclosure Secure reporting channel Penetration Testing Expert manual audits Crowdsourced Pentest Thousands of hackers, one goal Bug Bounty Success-based payment Live Hacking Live real-time pentesting For company teams Train your technical team For educational centers Bring hacking to the classroom For hackers Learn and get certified Competitions / CTFs Put your skills to the test
Customer Stories
View all Penetration Testing Manual pentesting VDP Secure reporting channel Pentest In-depth audits Crowdsourced Pentest Thousands of hackers, one goal Bug Bounty Success-based payment
Resources
About Secur0 Get to know us Jobs Join the team Media Kit Brand resources Contact Talk to us Newsletter Industry news Blog Articles and guides Partners Join the partner network We are a CNA We are a CVE Numbering Authority
Are you a hacker?
Request a demo Log in
Español English
Back to list
CVE-2026-59232 ·
Medium · July 31, 2026

Stored Cross-site Scripting in Prospero Flow CRM allows JavaScript execution via the lead form name field

S0
Secur0 CNA
CVE-2026-59232

Description

Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) (CWE-79), stored, in the lead index view (resources/views/lead/index.blade.php), exposed at GET /lead after a save through POST /lead/save, in Prospero Flow CRM 5.3.6, which allows an authenticated user holding the create lead or update lead permission to execute arbitrary JavaScript in the application origin via HTML markup entered in the lead form name field, because LeadRequest applied no sanitization or character restriction to that field and the persisted value is reintroduced into the response through two unneutralized paths: Blade's unescaped {!! !!} directive in the save confirmation message, which concatenates session('name') raw inside an anchor (line 28), and the onclick handler on the list's delete button, which interpolates the value inside a JavaScript string literal in an HTML attribute, where the quote escaping performed by {{ }} is reversed by the HTML parser before the script is evaluated (line 261), unlike line 100 of that same view, which renders the same value through {{ }} in a text context and is not exploitable. This results in arbitrary JavaScript execution in the application origin when the page renders. The supplied proof of concept demonstrates execution through the line 28 confirmation message, in the browser of the user who creates the lead: it does not demonstrate execution in the session of a user other than the attacker, nor access to the session cookie, which the application issues with the HttpOnly attribute and which is therefore not reachable from script, nor any of the downstream consequences asserted in the report.

Vulnerability type (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected versions

Prospero Flow CRM before 5.3.7 (fixed in 5.3.7 by commit 8b2633dd, dated 2026-06-23). The confirmation message sink was introduced in commit f832f405 (2022-08-31) and the onclick handler sink in commit d50dde19 (2022-07-09); both were present in the v1.0.0, v2.0.1 and v4.6.0 tags, so tagged releases did ship in a vulnerable state. Version 5.3.7 carries no git tag: the earliest tag containing the fix is v5.5.3. Versions are read from the APP_VERSION constant in version.php. Default status: unaffected.

Score (CVSS 4.0)

Medium (5.3)

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Solution

Upgrade to version 5.3.7 or higher. The fix was not tagged: the earliest tagged release containing it is v5.5.3.

Patch

Commit 8b2633dd

Credits

  • k1di3 - finder
  • Cristian Fernández Cornejo - analyst
  • Xoán M. Otero Jorge - analyst
  • Secur0 CNA - coordinator
  • Gustavo Novaro - remediation developer Discovery source: External Official record: CVE-2026-59232