Darío Rivas Quero

Improper link resolution in the kitty drag and drop protocol allows a client to create files outside the staging directory

CSRF in Prospero Flow CRM order confirmation allows unauthorized order state changes

Unrestricted upload of file with dangerous type in Prospero Flow CRM product photo allows stored cross-site scripting

Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG

Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers

Use of hard-coded credentials in Prospero Flow CRM employee onboarding

IDOR in Prospero Flow CRM allows cross-tenant product disclosure and hijacking

Stored Cross-site Scripting in Pentestify user account deletion via unescaped username

IDOR in Prospero Flow CRM allows cross-tenant ticket read, hijacking, and deletion

Authorization Bypass Through User-Controlled Key in Prospero Flow CRM contact save and vCard export