CVE-2026-81931 Unrestricted upload of file with dangerous type in Prospero Flow CRM product photo allows stored cross-site scripting

Unrestricted Upload of File with Dangerous Type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated user holding the create product permission routine Seller role to execute arbitrary JavaScript in the application origin. The photo validation rule...

CVE-2026-81031

IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middlewa...

EUVD-2026-66607

IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middlewa...

CVE-2026-81031 IDURAR ERP CRM through 4.1.1 Account Takeover via Unverified Identifier on Password Update

IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middlewa...

CVE-2026-81031 IDURAR ERP CRM through 4.1.1 Account Takeover via Unverified Identifier on Password Update

IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middlewa...

CVE-2026-81031

CVE-2026-81031 affects IDURAR ERP CRM through version 4.1.1 . The vulnerability resides in the password update handler (updatePassword.js), which applies a password change to the identifier in the URL path rather than verifying it matches the authenticated user. Because the route requires only a ...

CVE-2026-81031 IDURAR ERP CRM through 4.1.1 Account Takeover via Unverified Identifier on Password Update

IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middlewa...

CVE-2026-38526

CVE-2026-38526 - Krayin CRM PHP Upload RCE Automatisierter Exploit für Krayin CRM ≤ 2.2.x. Dieses Skript nutzt eine Schwachstelle für uneingeschränkten Dateiupload im TinyMCE-Endpunkt /admin/tinymce/upload aus, umgeht die MIME-Typ-Validierung durch Vortäuschung von image/jpeg, lädt eine...

PT-2026-82219

Name of the Vulnerable Software and Affected Versions IDURAR ERP CRM affected versions not specified Description An issue exists where the system changes the password of any account specified in a request instead of the account making the request. The update handler in...

CVE-2026-78365

Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/id setting companyid...

CVE-2026-78365

Roskus Prospero Flow CRM versions 4.0.0 through 5.3.1 are affected by an IDOR (Insecure Direct Object Reference) in the supplier API . A missing authorization check on the company_id field allows any authenticated user to send a PUT request to /api/supplier/{id} and set company_id in the body, en...

EUVD-2026-64839

Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/id setting companyid...

CVE-2026-78365 IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification

Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/id setting companyid...

CVE-2026-78365 IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification

Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/id setting companyid...

CVE-2026-78337

Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an...

CVE-2026-78337

Roskus Prospero Flow CRM versions before 5.15.13 are affected by an unrestricted file upload in the company logo feature. An authenticated user with create company and update company permissions can upload an SVG document containing an embedded script element , resulting in stored cross-site scri...

EUVD-2026-64825

Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an...

CVE-2026-78337 Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG

Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an...

CVE-2026-78337 Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG

Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an...

CVE-2026-77780

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a...