Advisory

Security Advisories

Original vulnerability research from the Payatu team, responsibly disclosed across mobile, web, connected devices, AI/ML products, hardware, firmware, and alot more.

100+

CVEs Disclosed

240+

Blogs & Write-ups

200+

Talks & Trainings

15+

Years of Research and Engagements
Red circular arrow icon indicating refresh or reload action on a transparent background.
Domain
Vulnerability Type
Severity
Black circular refresh icon with arrow pointing counterclockwise, symbolizing reset or reload.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Grid
List

Safari Address Bar Spoof

Safari Address Bar Spoof This vulnerability allows an attacker to spoof safari address bar
Browser
Spoofing
2022-10-03
Medium
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

massCode Code execution

massCode Code execution This vulnerability allows an attacker perfrom code execution on massCode editor
Developer Tools & Libraries
Cross-Site Scripting (XSS)
CWE-79
2022-10-03
Medium
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

Reflected XSS in GTranslate wordpress plugin

Reflected XSS in GTranslate plugin of wordpress The GTranslate plugin before 2.8.52 for WordPress has Reflected XSS via a crafted link.
Web / CMS
Cross-Site Scripting (XSS)
CWE-79
2022-10-03
Medium
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

WebKit - AXObjectCache - m_deferredFocusedNodeChange - UaF

Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.
Browser
Memory Corruption
CWE-416
2022-10-03
Critical
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

Apache Artemis - XSS Over MQTT

Stored XSS in Apache Artemis In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability.
IoT & Hardware
Cross-Site Scripting (XSS)
CWE-79
2022-10-03
Medium
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

Lack of Medical data encryption and integrity in Niscomed Multipara Patient Monitor

Lack of User’s Medical data encryption and integrity An issue was discovered on Nescomed Multipara Monitor M1000 devices.
Medical Devices
Information Disclosure
CWE-312
2022-10-03
High
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

Unauthenticated telnet service in niscomed patient Monitor

Open telnet port in niscomed patient monitoring device An issue was discovered on Niscomed Multipara Patient monitor M1000 devices.
Medical Devices
Authentication & Access Bypass
CWE-287, CWE-319
2022-10-03
High
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

Unautenticated UART port in niscomed patient monitoring device

Unautenticated UART port in niscomed patient monitoring An issue was discovered on Nescomed Multipara Monitor M1000 devices.The physical UART debug port provides a shell, without requiring a…
Medical Devices
Hardware / Firmware Exposure
Authentication & Access Bypass
CWE-306
2022-10-03
Medium
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

Lack of Medical data encryption in Dr.Trust ECG/EKG Pen

Lack of Medical data encryption in Dr.Trust ECG/EKG Pen.
Medical Devices
Information Disclosure
CWE-312
2022-10-03
Medium
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.
Critical

IDURAR ERP/CRM NoSQL injection

Enterprise & Mobile
SQL / NoSQL Injection
CWE-89
CWE-89
June 19, 2023
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2023-27742
CWE-89
2023-06-19
Medium

FluentForms <= 4.3.22 Stored XSS via Custom HTML fields

Web / CMS
Cross-Site Scripting (XSS)
CWE-79
CWE-79
June 19, 2023
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2023-0546
CWE-79
2023-06-19
Medium

AnyWhere Elementor <= 1.2.7 - Freemius API Key Disclosure

Web / CMS
Information Disclosure
CWE-200
CWE-200
June 19, 2023
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2023-0443
CWE-200
2023-06-19
High

Elementor Website Builder <= 3.10.0 - Admin+ SQLi

Web / CMS
SQL / NoSQL Injection
CWE-89
CWE-89
June 19, 2023
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2023-0329
CWE-89
2023-06-19
Medium

WPCode <= 2.0.6 - Contributor+ WPCode.com Library Connection Modification

Web / CMS
Authentication & Access Bypass
CWE-863
CWE-863
June 19, 2023
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2023-0328
CWE-863
2023-06-19
Low

Siri (iPhone 8 and later) - Meeting/Event Disclosure on Locked iPhone

Enterprise & Mobile
Information Disclosure
April 14, 2023
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2022-32871
2023-04-14
High

WP ALL Export Pro < 1.7.9 - Authenticated Code Injection

Web / CMS
Remote Code Execution
CWE-94
CWE-94
February 6, 2023
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2022-3394
CWE-94
2023-02-06
Medium

Import all XML, CSV & TXT into WordPress < 6.5.8 - Missing Authorisation

Web / CMS
Authentication & Access Bypass
CWE-862
CWE-862
February 6, 2023
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2022-3244
CWE-862
2023-02-06
Critical

SQL injection in School Management System 1.0

Web / CMS
SQL / NoSQL Injection
CWE-89, CWE-94
CWE-89, CWE-94
February 6, 2023
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2022-2054, CVE-2022-36193
CWE-89, CWE-94
2023-02-06
See it in action

Watch the exploit

Our researchers demonstrating the vulnerabilities they found the working chain, start to finish, on the real device.
Person in a black polo shirt with Payatu logo standing against a red-orange gradient background with the SolarWinds logo and text 'SAML 2.0 Authentication Bypass' on the left.
Dhabaleshwar Das Finds Critical SolarWinds SAML Authentication Bypass | CVE-2026-28323
Dhableshwar Das
White play button icon inside a solid red circle.Man in a black polo shirt with Payatu logo stands smiling against a dark purple gradient background with a green stylized circuit board icon and text saying 'Path Traversal in Binwalk WinCE Extraction'.
The Security Tool That Became the Attack Surface
Dhableshwar Das
White play button icon inside a solid red circle.
Go deeper

The full story

An advisory tells you what broke. These write-ups tell you how we found it, why the patch held, and what it means for your own stack.
Application Security
How a Double-Encoded Null Byte Turns a ZIP File into an XSS Vector – CVE-2026-2790
April 24, 2026
10 min
Application Security
Security leaders
Researchers
For Security Leaders
Browser Security
Security Operations Center (SOC)
The Chrome Extension That Stole the CEO’s Cookies: A Confession on AI, Trust, and Supply Chain Security
May 8, 2026
10 min
Browser Security
Security Operations Center (SOC)
Researchers
Security leaders
For Security Leaders
IoT & hardware
Exploit dev & reverse engineering
Binwalk Path Traversal Vulnerability: Turning Firmware Analysis into Code Execution
June 10, 2026
8 min
IoT & hardware
Exploit dev & reverse engineering
Security leaders
Researchers
For Security Leaders
Research & disclosures
Dark scene with vertical thin orange lines resembling distant illuminated bars or streaks against a black background and a faint horizontal red glow near the bottom.

These CVEs started as someone's untested product

Get the same research depth pointed at your firmware, app or cloud before it ships.

Book an assessment
White arrow pointing diagonally upward to the right on a black square background.White arrow pointing diagonally upward to the right on a black square background.White arrow pointing diagonally upward to the right on a black square background.
Black downward arrow on a white background.Black downward arrow on a white background.
This is the default text value
White arrow pointing downward on a dark background.White arrow pointing downward on a dark background.
This is the default text value
White arrow pointing downward on a dark background.White arrow pointing downward on a dark background.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.