Advisory

Security Advisories

Original vulnerability research from the Payatu team, responsibly disclosed across mobile, web, connected devices, AI/ML products, hardware, firmware, and alot more.

100+

CVEs Disclosed

240+

Blogs & Write-ups

200+

Talks & Trainings

15+

Years of Research and Engagements
Red circular arrow icon indicating refresh or reload action on a transparent background.
Domain
Vulnerability Type
Severity
Black circular refresh icon with arrow pointing counterclockwise, symbolizing reset or reload.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Grid
List

FluentSMTP <= 2.2.2 Stored XSS via Email Logs

FluentSMTP <= 2.2.2 Stored XSS via Email Logs The plugin does not sanitize or escape email content, making it vulnerable to stored cross-site scripting attacks (XSS) when an adminis
Web / CMS
Cross-Site Scripting (XSS)
CWE-79
2023-06-19
Medium
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

WP ALL Export Pro < 1.7.9 - Authenticated SQLi

WP ALL Export Pro < 1.7.9 – Authenticated SQLi The plugin does not limit some functionality during exports only to users with the Administrator role, allowing any logged in user which has been given…
Web / CMS
SQL / NoSQL Injection
CWE-89
2023-01-18
High
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

Import all XML, CSV & TXT into WordPress < 6.5.8 - Admin+ SQLi

Import all XML, CSV & TXT into WordPress < 6.5.8 – Admin+ SQLi The plugin does not properly sanitise and escape imported data before using them back SQL statements, leading to SQL injection…
Web / CMS
SQL / NoSQL Injection
CWE-89
2023-01-18
High
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

CloudSchool v3.0.1 is vulnerable to Cross Site Scripting (XSS)

CloudSchool v3.0.1 is vulnerable to Cross Site Scripting (XSS).
Web / CMS
Cross-Site Scripting (XSS)
CWE-79
2023-01-16
Medium
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

Flatpress v1.2.1 reflected XSS via page parameter at /flatpress/admin.php

Reflected XSS on page parameter in Flatpress 1.2.1 Page parameter does not sanitize input properly and reflect as it leads to reflected XSS attacks.
Web / CMS
Cross-Site Scripting (XSS)
CWE-79
2023-01-16
Medium
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

Remote code execution (RCE) via Upload File bypass in Flatpress 1.2.1

Remote code execution (RCE) vulnerability in the Upload File functionality in Flatpress 1.2.1 The application has the functionality to upload images and download them further.
Web / CMS
Remote Code Execution
CWE-434
2023-01-16
High
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

Drag and Drop Multiple File Upload < 1.3.6.5 - File Upload Size Limit Bypass

Drag and Drop Multiple File Upload < 1.3.6.5 – File Upload Size Limit Bypass The plugin does not properly check for the upload size limit set in forms, taking the value from user input sent when…
Web / CMS
Authentication & Access Bypass
CWE-639
2023-01-06
Medium
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

Command Injection in GitHub repository Nuitka/Nuitka prior to 0.9

Command Injection in GitHub repository Nuitka prior to 0.9.
Developer Tools & Libraries
Remote Code Execution
CWE-94
2022-10-05
High
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

Privilege Escalation in Konga v0.14.9

Konga v0.14.9 is affected by an incorrect access control vulnerability where a specially crafted request can lead to privilege escalation.
Developer Tools & Libraries
Authentication & Access Bypass
CWE-863
2022-10-05
High
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.
Medium

Stored Cross Site Scripting (XSS) in WordPress Clicksold IDX Plugin <= 1.90

Web / CMS
Cross-Site Scripting (XSS)
CWE-79
CWE-79
August 25, 2025
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2024-7769
CWE-79
2025-08-25
Medium

Stored Cross Site Scripting (XSS) in WordPress Simple Share Plugin <=0.5.3

Web / CMS
Cross-Site Scripting (XSS)
CWE-79
CWE-79
August 25, 2025
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2024-7556
CWE-79
2025-08-25
Medium

XSS in admiror gallery 5.2.0

Web / CMS
Cross-Site Scripting (XSS)
CWE-79
CWE-79
August 16, 2023
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2023-38045
CWE-79
2023-08-16
Critical

SQL Injection in Hikeshop via data[order][payment] parameter version < 4.7.3

Web / CMS
SQL / NoSQL Injection
CWE-89
CWE-89
August 16, 2023
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2023-38044
CWE-89
2023-08-16
Critical

SQL injection in online virtual classroom via cid parameter

Web / CMS
SQL / NoSQL Injection
CWE-89
CWE-89
August 16, 2023
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2023-34477
CWE-89
2023-08-16
Critical

SQL Injection in Proforms Basic via sort_order parameter

Web / CMS
SQL / NoSQL Injection
CWE-89
CWE-89
August 16, 2023
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2023-34476
CWE-89
2023-08-16
Critical

SQL Injection in Creative Gallery via id parameter

Web / CMS
SQL / NoSQL Injection
CWE-89
CWE-89
August 16, 2023
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2023-23758
CWE-89
2023-08-16
Medium

Unvalidated open redirection Fuge CMS v1.0

Web / CMS
Spoofing
CWE-601
CWE-601
July 20, 2023
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2023-34916
CWE-601
2023-07-20
Medium

Unvalidated redirection vulnerability in Fuge CMS v1.0

Web / CMS
Spoofing
CWE-601
CWE-601
July 20, 2023
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2023-34917
CWE-601
2023-07-20
See it in action

Watch the exploit

Our researchers demonstrating the vulnerabilities they found the working chain, start to finish, on the real device.
Person in a black polo shirt with Payatu logo standing against a red-orange gradient background with the SolarWinds logo and text 'SAML 2.0 Authentication Bypass' on the left.
Dhabaleshwar Das Finds Critical SolarWinds SAML Authentication Bypass | CVE-2026-28323
Dhableshwar Das
White play button icon inside a solid red circle.Man in a black polo shirt with Payatu logo stands smiling against a dark purple gradient background with a green stylized circuit board icon and text saying 'Path Traversal in Binwalk WinCE Extraction'.
The Security Tool That Became the Attack Surface
Dhableshwar Das
White play button icon inside a solid red circle.
Go deeper

The full story

An advisory tells you what broke. These write-ups tell you how we found it, why the patch held, and what it means for your own stack.
Application Security
How a Double-Encoded Null Byte Turns a ZIP File into an XSS Vector – CVE-2026-2790
April 24, 2026
10 min
Application Security
Security leaders
Researchers
For Security Leaders
Browser Security
Security Operations Center (SOC)
The Chrome Extension That Stole the CEO’s Cookies: A Confession on AI, Trust, and Supply Chain Security
May 8, 2026
10 min
Browser Security
Security Operations Center (SOC)
Researchers
Security leaders
For Security Leaders
IoT & hardware
Exploit dev & reverse engineering
Binwalk Path Traversal Vulnerability: Turning Firmware Analysis into Code Execution
June 10, 2026
8 min
IoT & hardware
Exploit dev & reverse engineering
Security leaders
Researchers
For Security Leaders
Research & disclosures
Dark scene with vertical thin orange lines resembling distant illuminated bars or streaks against a black background and a faint horizontal red glow near the bottom.

These CVEs started as someone's untested product

Get the same research depth pointed at your firmware, app or cloud before it ships.

Book an assessment
White arrow pointing diagonally upward to the right on a black square background.White arrow pointing diagonally upward to the right on a black square background.White arrow pointing diagonally upward to the right on a black square background.
Black downward arrow on a white background.Black downward arrow on a white background.
This is the default text value
White arrow pointing downward on a dark background.White arrow pointing downward on a dark background.
This is the default text value
White arrow pointing downward on a dark background.White arrow pointing downward on a dark background.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.