Web Security From Curiosity to CVE: How I Found a CSRF Privilege Escalation Bug A critical CSRF vulnerability in Sell Done Storefront v.1.0. March 5 , 2025