RESEARCH

Published findings with demonstrated impact

Vulnerabilities found during audits and bug bounty programmes. Each analysis is anonymised and published with the prior authorisation of the affected party.

Date	Severity	CVSS	Finding	Target
Aug 2026	Critical	9.3	When a UUID is not authorisation: customer receipts exposed by chaining two IDORs	Customer billing platform
Jul 2026	High	8.3	Cache poisoning through a header left out of the cache key	Corporate site behind a CDN
Jun 2026	Critical	9.1	Second factor skipped: the session was issued before the code was checked	Private client area
May 2026	High	8.6	The 403 from the admin panel came back with the full invoice list in the body	B2B invoicing portal
Apr 2026	Critical	9.8	Blind SQL injection in an HTTP header leading to command execution	Corporate web application
Mar 2026	High	8.6	IDOR in a REST API leading to mass exposure of personal data	Corporate management application
Feb 2026	High	8.1	Stored XSS and CSRF chain leading to administrator account takeover	Corporate web application
Jan 2026	High	7.5	OTP bypass by changing the case of the email address	Applications with an email second factor

ANALYSIS

Analyses in detail

Every finding has its own page, and a selection is summarised here. Each analysis sets out the vector, the impact and the remediation. Full reports go only to the audited client.

Apr 2026CriticalCVSS 9.8Target: Corporate web application

Blind SQL injection in an HTTP header leading to command execution

SQLi
RCE
Header injection
CWE-89
CWE-78

Time-based blind SQL injection in the X-Forwarded-For proxy header. The value reached the query without parameterisation, allowing stacked statements. The database user held administrative privileges: the chain reached the stored procedures that run operating-system commands.

Impact

A route open to command execution on the database server and to the databases hosted on it. The chain was verified up to the step before impact.

Read the analysis

Mar 2026HighCVSS 8.6Target: Corporate management application

IDOR in a REST API leading to mass exposure of personal data

IDOR
BOLA
API
PII leak
CWE-639

Insecure direct object reference in an API endpoint: changing a sequential numeric identifier in the JSON body returned any user’s record. With no object-level authorisation check, extraction could be fully automated.

Impact

Exposure of any user’s identifying and contact details: name, ID document, phone, email, address and company. Photographs, identity scans, signatures and certificates were exposed as well. Risk of impersonation and of a GDPR penalty.

Read the analysis

Feb 2026HighCVSS 8.1Target: Corporate web application

Stored XSS and CSRF chain leading to administrator account takeover

XSS
CSRF
Account takeover
CWE-79
CWE-352

Stored XSS in the profile’s “organisation name” field, rendered unsanitised inside the admin panel. The email-change endpoint had no CSRF check. The chain pointed an administrator’s account at a mailbox the attacker controlled and completed the password reset from there.

Impact

Full takeover of administrator accounts, access to the admin panel and potential escalation into internal systems.

Read the analysis

Jan 2026HighCVSS 7.5Target: Applications with an email second factor

OTP bypass by changing the case of the email address

OTP bypass
2FA
Brute force
CWE-178
CWE-307

The system treated upper- and lower-case variations of an email address as distinct identities. Each variation received its own OTP, with its own attempt limit. Since the mail provider delivers every variation to the same mailbox, the number of simultaneously valid codes multiplied.

Impact

Bypass of the second factor’s rate limit: 192 attempts per round instead of the 3 the control allowed.

Read the analysis

DISCLOSURE

Responsible disclosure channel

We acknowledge every report and reply with a reasoned decision, whether or not the finding is accepted.

Read the disclosure policy

Request a proposal with the scope defined

Tell us which assets you want tested. We reply within 24 hours.

Request a proposal