https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 03:01:59 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-59239 <p>Stored Cross-site Scripting (CWE-79) in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute arbitrary JavaScript in another user&#39;s browser, including administrators, leading to session compromise and account takeover, via a payload stored in an email body that is persisted without sanitization and rendered unescaped with {!! $email-&gt;body !!} when the recipient opens the message.</p> <p>Stored Cross-site Scripting (CWE-79) in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute arbitrary JavaScript in another user&#39;s browser, including administrators, leading to session compromise and account takeover, via a payload stored in an email body that is persisted without sanitization and rendered unescaped with {!! $email-&gt;body !!} when the recipient opens the message.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-59239 https://vulnerability.circl.lu/vuln/ghsa-wpjv-rrg6-52x9 <p>Stored Cross-site Scripting (CWE-79) in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute arbitrary JavaScript in another user&#39;s browser, including administrators, leading to session compromise and account takeover, via a payload stored in an email body that is persisted without sanitization and rendered unescaped with {!! $email-&gt;body !!} when the recipient opens the message.</p> <p>Stored Cross-site Scripting (CWE-79) in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute arbitrary JavaScript in another user&#39;s browser, including administrators, leading to session compromise and account takeover, via a payload stored in an email body that is persisted without sanitization and rendered unescaped with {!! $email-&gt;body !!} when the recipient opens the message.</p> https://vulnerability.circl.lu/vuln/ghsa-wpjv-rrg6-52x9