Xoán M. Otero Jorge

IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records

HTML Injection in MailerUp double opt-in verification email

IDOR in Prospero Flow CRM allows cross-tenant payroll disclosure and creation

Use of hard-coded credentials in Prospero Flow CRM employee onboarding

Stored Cross-site Scripting in Pentestify Markdown renderer via unescaped quotes

IDOR in Prospero Flow CRM allows cross-tenant product disclosure and hijacking

Stored Cross-site Scripting in Pentestify user account deletion via unescaped username

IDOR in Prospero Flow CRM allows cross-tenant ticket read, hijacking, and deletion

Stored Cross-site Scripting in Pentestify finding severity field

Authorization Bypass Through User-Controlled Key in Prospero Flow CRM contact save and vCard export