← All credits
Marco Paciaroni (BomboBombone)
25 vulnerability records and advisories credit this contributor.
CVE-2026-73315
XenForo < 2.3.13 SSRF via PayPal REST Webhook Handler
CVE-2026-73314
XenForo < 2.3.13 Signature Verification Bypass via PayPal REST Webhook
CVE-2026-73313
XenForo < 2.3.13 MFA Bypass via Passkey TFA Provider
CVE-2026-73312
XenForo < 2.3.13 Refresh Token Replay via Expired Access Token
CVE-2026-73311
XenForo < 2.3.13 OAuth2 Authorization Code Reuse
CVE-2026-73310
XenForo < 2.3.13 OAuth2 Authorization Code Token Theft via redirect_uri Bypass
CVE-2026-73309
XenForo < 2.3.13 Authentication Bypass via OAuth2 Token Endpoint
CVE-2026-103443
API permits session-seeded javascript URL XSS
CVE-2026-103445
Stored XSS through PageForms #autoedit redirect links
CVE-2026-103437
ReadingLists imported metadata permits JavaScript URL XSS