Gustavo Novaro

CSRF in Prospero Flow CRM order confirmation allows unauthorized order state changes

Unrestricted upload of file with dangerous type in Prospero Flow CRM product photo allows stored cross-site scripting

IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification

Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG

Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers

IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records

IDOR in Prospero Flow CRM allows deletion of other users' notifications

Stored XSS in Prospero Flow CRM email body allows administrator account takeover

Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation

Stored Cross-site Scripting in Prospero Flow CRM lead name field