Secur0 CNA

Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG

Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers

IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records

CSS sanitizer bypass in Pentestify report themes allows forced outbound requests

HTML Injection in MailerUp double opt-in verification email

IDOR in Prospero Flow CRM allows deletion of other users' notifications

Stored XSS in Prospero Flow CRM email body allows administrator account takeover

Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation

Stored Cross-site Scripting in Prospero Flow CRM lead name field

Server-Side Request Forgery in Pentestify PDF export via unvalidated image URLs