Xoán M. Otero Jorge

Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation

Server-Side Request Forgery in Pentestify PDF export via unvalidated image URLs

Stored Cross-site Scripting in Prospero Flow CRM lead name field

Stored XSS in Prospero Flow CRM email body allows administrator account takeover

Stored XSS in Pentestify via unsanitized finding images and report client logo

IDOR in Prospero Flow CRM Order API allows cross-tenant read and modification of orders