Cristian Fernández Cornejo

IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records

IDOR in Prospero Flow CRM allows cross-tenant payroll disclosure and creation

IDOR in Prospero Flow CRM allows cross-tenant product disclosure and hijacking

IDOR in Prospero Flow CRM allows cross-tenant ticket read, hijacking, and deletion

Stored Cross-site Scripting in Pentestify finding severity field

Authorization Bypass Through User-Controlled Key in Prospero Flow CRM contact save and vCard export

Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation

Stored Cross-site Scripting in Prospero Flow CRM lead name field

Missing authorization in Prospero Flow CRM allows low-privileged users to read all bank accounts

Authorization bypass in Prospero Flow CRM Excel import allows cross-tenant record injection