⚠ Vulnerable Rendering — HTML Injection (HackerOne #3079966)
Each message below is rendered via
<?php echo $row['message']; ?> — no
htmlspecialchars() applied.
Any HTML tags in user messages render as real HTML here. Send a payload from the
chat widget, then refresh this page to see it render.