Secur0 CNA

Unescaped header separators in whatstk build a regular expression that backtracks exponentially

Silent loss of messages when merging overlapping chat exports in whatstk

Missing authorization in the Prospero Flow CRM user API allows a basic role user to read and delete other accounts

Cross user deletion and modification of cart and wishlist rows in Ecommerce Template through unscoped primary key queries

Price manipulation in the Ecommerce Template checkout flow through a client supplied Stripe price identifier

Incomplete dangerous-extension list in PeaZip object open allows execution of a program or command from a crafted archive entry without confirmation

Account pre-hijacking in the Prowler API through email based social account linking without verification

Path traversal in PeaZip object preview allows execution of arbitrary programs via a crafted archive entry name

Out-of-bounds write in PeaZip PEA extractor allows code execution via a crafted .pea archive

Missing authentication in Ecommerce Template product cache revalidation allows unauthenticated denial of service