Xoán M. Otero Jorge

Use of hard-coded credentials in Prospero Flow CRM employee onboarding

Stored Cross-site Scripting in Pentestify Markdown renderer via unescaped quotes

IDOR in Prospero Flow CRM allows cross-tenant product disclosure and hijacking

Stored Cross-site Scripting in Pentestify user account deletion via unescaped username

IDOR in Prospero Flow CRM allows cross-tenant ticket read, hijacking, and deletion

Stored Cross-site Scripting in Pentestify finding severity field

Authorization Bypass Through User-Controlled Key in Prospero Flow CRM contact save and vCard export

Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation

Server-Side Request Forgery in Pentestify PDF export via unvalidated image URLs

Stored Cross-site Scripting in Prospero Flow CRM lead name field