CyberRota Analysis
AI-GeneratedThe email module in Roskus Prospero Flow CRM versions prior to 5.4.4 is vulnerable to stored cross-site scripting, allowing authenticated low-privileged users to inject arbitrary JavaScript into email bodies. This can lead to session compromise and account takeover for any recipient, including administrators, when the email is opened. Organizations using this CRM should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Stored Cross-site Scripting (CWE-79) in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute arbitrary JavaScript in another user's browser, including administrators, leading to session compromise and account takeover, via a payload stored in an email body that is persisted without sanitization and rendered unescaped with {!! $email->body !!} when the recipient opens the message.