// Research

Threat Intelligence & Disclosures

Security advisories published by our offensive research team. Every disclosure follows coordinated responsible disclosure standards - vendors are contacted and given reasonable remediation time before publication.

CRITICALJuly 2026

SDX-2026-001

Authentication Bypass via SAML Signature Algorithm Confusion in miniOrange SAML SSO

Executive Summary In July 2026, during a security assessment of a target organization's web infrastructure, the SDX Shadow Labs research ...

SAMLAuthentication BypassWordPressCVE-2026-15013Cryptography

Read Full Advisory

CRITICALNov 2025

SDX-2025-001

Chained SQL Injection Vulnerabilities in Large Private Educational Technical Support System

Executive Summary In November 2025, the SDX Shadow Labs offensive research team conducted an unauthorizedaccess vulnerability analysis on ...

SQL InjectionPII LeakMobile API

Read Full Advisory

CRITICALJuly 2025

SDX-2025-002

Remote Code Execution (RCE) via Unauthenticated Redis Exposure on EdTech Server

Executive Summary In July 2025, during a blackbox infrastructure security assessment for an earlystage educational technology startup, the...

RCEData ExfiltrationServer SecurityRedis

Read Full Advisory

CRITICALDec 2024

SDX-2024-002

Remote Code Execution (RCE) and System Compromise in University Administration Portal

Executive Summary In December 2024, the SDX Shadow Labs research division performed a vulnerability assessment of a public university admi...

RCEPrivilege EscalationDatabase Compromise

Read Full Advisory

HIGHJuly 2024

SDX-2024-001

Premium Course Access and Certification Generation Bypass on EdTech Platform

Executive Summary In July 2024, the SDX Shadow Labs offensive security team identified a critical Broken Access Control (BAC) vulnerabilit...

Auth BypassBusiness LogicEdTechBroken Access Control

Read Full Advisory

// Subscribe

Get notified when we publish new advisories.

By subscribing, you agree to receive security advisories per our Privacy Policy. No spam. Unsubscribe anytime.