Gustavo Novaro

Use of hard-coded credentials in Prospero Flow CRM employee onboarding

IDOR in Prospero Flow CRM allows cross-tenant payroll disclosure and creation

IDOR in Prospero Flow CRM allows cross-tenant product disclosure and hijacking

IDOR in Prospero Flow CRM allows cross-tenant ticket read, hijacking, and deletion

Authorization Bypass Through User-Controlled Key in Prospero Flow CRM contact save and vCard export

IDOR in Prospero Flow CRM Order API allows cross-tenant read and modification of orders

Authorization bypass in Prospero Flow CRM Excel import allows cross-tenant record injection

Missing authorization in Prospero Flow CRM allows low-privileged users to read all bank accounts

Authorization Bypass Through User-Controlled Key in Prospero Flow CRM calendar event deletion