CyberRota Analysis
AI-GeneratedThe vulnerability affects the Roskus Prospero Flow CRM prior to version 5.15.13, allowing authenticated users with specific permissions to upload malicious SVG files containing embedded JavaScript. This could lead to the execution of arbitrary scripts within the application, potentially compromising the integrity of the system and exposing sensitive data. Organizations using this CRM should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an embedded script element.