Secur0 CNA

IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification

Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG

CSS sanitizer bypass in Pentestify report themes allows forced outbound requests

Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers

IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records

HTML Injection in MailerUp double opt-in verification email

IDOR in Prospero Flow CRM allows cross-tenant payroll disclosure and creation

Use of hard-coded credentials in Prospero Flow CRM employee onboarding

Stored Cross-site Scripting in Pentestify Markdown renderer via unescaped quotes

IDOR in Prospero Flow CRM allows cross-tenant product disclosure and hijacking