Secur0 CNA

Stored Cross-site Scripting in Pentestify user account deletion via unescaped username

IDOR in Prospero Flow CRM allows cross-tenant ticket read, hijacking, and deletion

Stored Cross-site Scripting in Pentestify finding severity field

Authorization Bypass Through User-Controlled Key in Prospero Flow CRM contact save and vCard export

Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation

Server-Side Request Forgery in Pentestify PDF export via unvalidated image URLs

Stored Cross-site Scripting in Prospero Flow CRM lead name field

IDOR in Prospero Flow CRM allows deletion of other users' notifications

Stored XSS in Prospero Flow CRM email body allows administrator account takeover

Stored XSS in Pentestify via unsanitized finding images and report client logo