Advisory

Security Advisories

Original vulnerability research from the Payatu team, responsibly disclosed across mobile, web, connected devices, AI/ML products, hardware, firmware, and alot more.

100+

CVEs Disclosed

240+

Blogs & Write-ups

200+

Talks & Trainings

15+

Years of Research and Engagements
Red circular arrow icon indicating refresh or reload action on a transparent background.
Domain
Vulnerability Type
Severity
Black circular refresh icon with arrow pointing counterclockwise, symbolizing reset or reload.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Grid
List

Cross Site Scripting (XSS) vulnerability in username field in chatbox functionality in ChatEngine 1.0

Cross Site Scripting (XSS) vulnerability in username field in chatbox functionality in ChatEngine 1.0 The Application does not sanitize or escape username parameter, making it vulnerable to reflected
Web / CMS
Cross-Site Scripting (XSS)
CWE-79
2023-07-05
Medium
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

SQL Injection vulnerability in textMessage field in ChatEngine 1.0

SQL Injection vulnerability in textMessage field in ChatEngine 1.0 The Application does not sanitize or escape txtmessage parameter, making it vulnerable to sql injection.
Web / CMS
SQL / NoSQL Injection
CWE-89
2023-07-05
High
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

SQL Injection in chatWindow functionality in ChatEngine 1.0

SQL Injection in chatWindow functionality in ChatEngine 1.0 The Application does not sanitize or escape username parameter, making it vulnerable to sql injection.
Web / CMS
SQL / NoSQL Injection
CWE-89
2023-07-05
High
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

Cross Site Scripting (XSS) in username field in chatWindow functionality in ChatEngine 1.0

Cross Site Scripting (XSS) in username field in chatWindow functionality in ChatEngine 1.0 ThThe Application does not sanitize or escape username parameter, making it vulnerable to Stored cross-site
Web / CMS
Cross-Site Scripting (XSS)
CWE-79
2023-07-05
Medium
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

Cross Site Scripting (XSS) textMessage field in Login functionality in ChatEngine 1.0

Cross Site Scripting (XSS) vulnerability in textMessage field in /src/chatbotapp/LoginServlet.java in wliang6 ChatEngine commit fded8e710ad59f816867ad47d7fc4862f6502f3e, allows attackers to execute
Web / CMS
Cross-Site Scripting (XSS)
CWE-79
2023-07-03
Critical
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

Cross Site Scripting (XSS) in textMessage field in ChatEngine 1.0

Cross Site Scripting (XSS) vulnerability in textMessage field in /src/chatbotapp/chatWindow.java in wliang6 ChatEngine commit fded8e710ad59f816867ad47d7fc4862f6502f3e, allows attackers to execute
Web / CMS
Cross-Site Scripting (XSS)
CWE-79
2023-07-03
Critical
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

Cross Site Scripting (XSS) in username field in ChatEngine 1.0

Cross Site Scripting (XSS) vulnerability in username field in /src/chatbotapp/LoginServlet.java in wliang6 ChatEngine, allows attackers to execute arbitrary code.
Web / CMS
Cross-Site Scripting (XSS)
CWE-79
2023-07-03
Critical
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

Upload Resume <= 1.2.0 - Captcha Bypass

Upload Resume <= 1.2.0 – Captcha Bypass The plugin does not validate the captcha parameter when uploading a resume via the resume_upload_form shortcode, allowing unauthenticated visitors to upload
Web / CMS
Authentication & Access Bypass
CWE-639
2023-06-19
Medium
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

Stagtools < 2.3.7 - Contributor+ Stored XSS

Stagtools < 2.3.7 – Contributor+ Stored XSS The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which
Web / CMS
Cross-Site Scripting (XSS)
CWE-79
2023-06-19
Medium
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.
Medium

Cross Site Scripting (XSS) vulnerability in username field in chatbox functionality in ChatEngine 1.0

Web / CMS
Cross-Site Scripting (XSS)
CWE-79
CWE-79
July 5, 2023
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2023-30326
CWE-79
2023-07-05
High

SQL Injection vulnerability in textMessage field in ChatEngine 1.0

Web / CMS
SQL / NoSQL Injection
CWE-89
CWE-89
July 5, 2023
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2023-30325
CWE-89
2023-07-05
High

SQL Injection in chatWindow functionality in ChatEngine 1.0

Web / CMS
SQL / NoSQL Injection
CWE-89
CWE-89
July 5, 2023
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2023-30323
CWE-89
2023-07-05
Medium

Cross Site Scripting (XSS) in username field in chatWindow functionality in ChatEngine 1.0

Web / CMS
Cross-Site Scripting (XSS)
CWE-79
CWE-79
July 5, 2023
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2023-30322
CWE-79
2023-07-05
Critical

Cross Site Scripting (XSS) textMessage field in Login functionality in ChatEngine 1.0

Web / CMS
Cross-Site Scripting (XSS)
CWE-79
CWE-79
July 3, 2023
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2023-30321
CWE-79
2023-07-03
Critical

Cross Site Scripting (XSS) in textMessage field in ChatEngine 1.0

Web / CMS
Cross-Site Scripting (XSS)
CWE-79
CWE-79
July 3, 2023
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2023-30320
CWE-79
2023-07-03
Critical

Cross Site Scripting (XSS) in username field in ChatEngine 1.0

Web / CMS
Cross-Site Scripting (XSS)
CWE-79
CWE-79
July 3, 2023
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2023-30319
CWE-79
2023-07-03
Medium

Upload Resume <= 1.2.0 - Captcha Bypass

Web / CMS
Authentication & Access Bypass
CWE-639
CWE-639
June 19, 2023
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2023-2751
CWE-639
2023-06-19
Medium

Stagtools < 2.3.7 - Contributor+ Stored XSS

Web / CMS
Cross-Site Scripting (XSS)
CWE-79
CWE-79
June 19, 2023
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2023-0891
CWE-79
2023-06-19
See it in action

Watch the exploit

Our researchers demonstrating the vulnerabilities they found the working chain, start to finish, on the real device.
Person in a black polo shirt with Payatu logo standing against a red-orange gradient background with the SolarWinds logo and text 'SAML 2.0 Authentication Bypass' on the left.
Dhabaleshwar Das Finds Critical SolarWinds SAML Authentication Bypass | CVE-2026-28323
Dhableshwar Das
White play button icon inside a solid red circle.Man in a black polo shirt with Payatu logo stands smiling against a dark purple gradient background with a green stylized circuit board icon and text saying 'Path Traversal in Binwalk WinCE Extraction'.
The Security Tool That Became the Attack Surface
Dhableshwar Das
White play button icon inside a solid red circle.
Go deeper

The full story

An advisory tells you what broke. These write-ups tell you how we found it, why the patch held, and what it means for your own stack.
Application Security
How a Double-Encoded Null Byte Turns a ZIP File into an XSS Vector – CVE-2026-2790
April 24, 2026
10 min
Application Security
Security leaders
Researchers
For Security Leaders
Browser Security
Security Operations Center (SOC)
The Chrome Extension That Stole the CEO’s Cookies: A Confession on AI, Trust, and Supply Chain Security
May 8, 2026
10 min
Browser Security
Security Operations Center (SOC)
Researchers
Security leaders
For Security Leaders
IoT & hardware
Exploit dev & reverse engineering
Binwalk Path Traversal Vulnerability: Turning Firmware Analysis into Code Execution
June 10, 2026
8 min
IoT & hardware
Exploit dev & reverse engineering
Security leaders
Researchers
For Security Leaders
Research & disclosures
Dark scene with vertical thin orange lines resembling distant illuminated bars or streaks against a black background and a faint horizontal red glow near the bottom.

These CVEs started as someone's untested product

Get the same research depth pointed at your firmware, app or cloud before it ships.

Book an assessment
White arrow pointing diagonally upward to the right on a black square background.White arrow pointing diagonally upward to the right on a black square background.White arrow pointing diagonally upward to the right on a black square background.
Black downward arrow on a white background.Black downward arrow on a white background.
This is the default text value
White arrow pointing downward on a dark background.White arrow pointing downward on a dark background.
This is the default text value
White arrow pointing downward on a dark background.White arrow pointing downward on a dark background.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.