Darío Rivas

Unescaped header separators in whatstk build a regular expression that backtracks exponentially

Silent loss of messages when merging overlapping chat exports in whatstk

Missing authorization in the Prospero Flow CRM user API allows a basic role user to read and delete other accounts

Cross user deletion and modification of cart and wishlist rows in Ecommerce Template through unscoped primary key queries

Price manipulation in the Ecommerce Template checkout flow through a client supplied Stripe price identifier

Account pre-hijacking in the Prowler API through email based social account linking without verification