← All credits
Gustavo Novaro
19 vulnerability records and advisories credit this contributor.
CVE-2026-82911
CSRF in Prospero Flow CRM order confirmation allows unauthorized order state changes
CVE-2026-81931
Unrestricted upload of file with dangerous type in Prospero Flow CRM product photo allows stored cross-site scripting
CVE-2026-78365
IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification
CVE-2026-78337
Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG
CVE-2026-77780
Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers
CVE-2026-77759
IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records
CVE-2026-19870
IDOR in Prospero Flow CRM allows cross-tenant payroll disclosure and creation
CVE-2026-19871
Use of hard-coded credentials in Prospero Flow CRM employee onboarding
CVE-2026-19734
IDOR in Prospero Flow CRM allows cross-tenant product disclosure and hijacking
CVE-2026-19539
IDOR in Prospero Flow CRM allows cross-tenant ticket read, hijacking, and deletion