BomboBombone.exe
ARCHITECTURE:x86-64
BACK
.RSRCRESEARCH INDEX
34 CVEs
Marco Paciaroni

MARCO PACIARONI · BomboBombone

Currently public CVEs: 34

Grouped by target and bug class, with a write-up and public references for each finding.

.rsrc:cves

Public CVEs

2 targets · grouped by bug class

XenForo

14 CVEs

OAuth2

4
CVEWRITE-UPREFERENCES
CVE-2026-73309 CVE-2026-73309: Empty OAuth2 credentials bypass ADVISORY for CVE-2026-73309 (opens in a new tab) CVE record for CVE-2026-73309 (opens in a new tab)
CVE-2026-73310 CVE-2026-73310: OAuth2 redirect URI mismatch ADVISORY for CVE-2026-73310 (opens in a new tab) CVE record for CVE-2026-73310 (opens in a new tab)
CVE-2026-73311 CVE-2026-73311: OAuth2 authorization code replay ADVISORY for CVE-2026-73311 (opens in a new tab) CVE record for CVE-2026-73311 (opens in a new tab)
CVE-2026-73312 CVE-2026-73312: Refresh token replay after access-token expiry ADVISORY for CVE-2026-73312 (opens in a new tab) CVE record for CVE-2026-73312 (opens in a new tab)

Authentication

1
CVEWRITE-UPREFERENCES
CVE-2026-73313 CVE-2026-73313: Passkey accepted for the wrong account ADVISORY for CVE-2026-73313 (opens in a new tab) CVE record for CVE-2026-73313 (opens in a new tab)

Payments

2
CVEWRITE-UPREFERENCES
CVE-2026-73314 CVE-2026-73314: PayPal signature check bypass ADVISORY for CVE-2026-73314 (opens in a new tab) CVE record for CVE-2026-73314 (opens in a new tab)
CVE-2026-73316 CVE-2026-73316: PayPal webhook replay ADVISORY for CVE-2026-73316 (opens in a new tab) CVE record for CVE-2026-73316 (opens in a new tab)

SSRF

1
CVEWRITE-UPREFERENCES
CVE-2026-73315 CVE-2026-73315: PayPal certificate URL SSRF ADVISORY for CVE-2026-73315 (opens in a new tab) CVE record for CVE-2026-73315 (opens in a new tab)

Authorization

2
CVEWRITE-UPREFERENCES
CVE-2026-73317 CVE-2026-73317: ACP rebuild authorization bypass ADVISORY for CVE-2026-73317 (opens in a new tab) CVE record for CVE-2026-73317 (opens in a new tab)
CVE-2026-73318 CVE-2026-73318: Missing permission checks on agreement resets ADVISORY for CVE-2026-73318 (opens in a new tab) CVE record for CVE-2026-73318 (opens in a new tab)

XSS

1
CVEWRITE-UPREFERENCES
CVE-2026-73319 CVE-2026-73319: JavaScript URI in dynamic redirects ADVISORY for CVE-2026-73319 (opens in a new tab) CVE record for CVE-2026-73319 (opens in a new tab)

Information disclosure

1
CVEWRITE-UPREFERENCES
CVE-2026-73320 CVE-2026-73320: Unauthenticated unfurl result disclosure ADVISORY for CVE-2026-73320 (opens in a new tab) CVE record for CVE-2026-73320 (opens in a new tab)

Denial of service

1
CVEWRITE-UPREFERENCES
CVE-2026-73321 CVE-2026-73321: Stack overflow in BBCode parsing ADVISORY for CVE-2026-73321 (opens in a new tab) CVE record for CVE-2026-73321 (opens in a new tab)

Path traversal

1
CVEWRITE-UPREFERENCES
CVE-2026-74239 CVE-2026-74239: Windows path traversal in style imports ADVISORY for CVE-2026-74239 (opens in a new tab) CVE record for CVE-2026-74239 (opens in a new tab)

MediaWiki

20 CVEs

Authorization

4
CVEWRITE-UPREFERENCES
CVE-2026-96872 CVE-2026-96872: WikiLambda nested Z825 bypassed the unsaved-code check FIX for CVE-2026-96872 (opens in a new tab) CVE record for CVE-2026-96872 (opens in a new tab)
CVE-2026-102973 CVE-2026-102973: API email sending skipped an authorization hook ADVISORY for CVE-2026-102973 (opens in a new tab) CVE record for CVE-2026-102973 (opens in a new tab)
CVE-2026-102975 CVE-2026-102975: RevisionDelete API could remove suppression without the required right ADVISORY for CVE-2026-102975 (opens in a new tab) CVE record for CVE-2026-102975 (opens in a new tab)
CVE-2026-103446 CVE-2026-103446: Anonymous WikiLambda fragment execution ADVISORY for CVE-2026-103446 (opens in a new tab) FIX for CVE-2026-103446 (opens in a new tab) CVE record for CVE-2026-103446 (opens in a new tab)

XSS

12
CVEWRITE-UPREFERENCES
CVE-2026-96873 CVE-2026-96873: Reflected XSS in CirrusSearch explain output FIX for CVE-2026-96873 (opens in a new tab) CVE record for CVE-2026-96873 (opens in a new tab)
CVE-2026-96874 CVE-2026-96874: Stored XSS in Cargo Drilldown tab names FIX for CVE-2026-96874 (opens in a new tab) CVE record for CVE-2026-96874 (opens in a new tab)
CVE-2026-96875 CVE-2026-96875: Reflected XSS in Cargo Drilldown hierarchy filters FIX for CVE-2026-96875 (opens in a new tab) CVE record for CVE-2026-96875 (opens in a new tab)
CVE-2026-96876 CVE-2026-96876: Anonymous reflected XSS in CargoExport errors FIX for CVE-2026-96876 (opens in a new tab) CVE record for CVE-2026-96876 (opens in a new tab)
CVE-2026-96877 CVE-2026-96877: Reflected XSS in Cargo Drilldown full-text search FIX for CVE-2026-96877 (opens in a new tab) CVE record for CVE-2026-96877 (opens in a new tab)
CVE-2026-96878 CVE-2026-96878: Stored XSS through Cargo Exhibit field aliases FIX for CVE-2026-96878 (opens in a new tab) CVE record for CVE-2026-96878 (opens in a new tab)
CVE-2026-100380 CVE-2026-100380: Reflected XSS in Wikibase SetLabel errors FIX for CVE-2026-100380 (opens in a new tab) CVE record for CVE-2026-100380 (opens in a new tab)
CVE-2026-100381 CVE-2026-100381: DOM XSS in UploadWizard Flickr titles FIX for CVE-2026-100381 (opens in a new tab) CVE record for CVE-2026-100381 (opens in a new tab)
CVE-2026-103437 CVE-2026-103437: XSS through imported ReadingLists links ADVISORY for CVE-2026-103437 (opens in a new tab) CVE record for CVE-2026-103437 (opens in a new tab)
CVE-2026-103445 CVE-2026-103445: Stored XSS in PageForms auto-edit links ADVISORY for CVE-2026-103445 (opens in a new tab) FIX for CVE-2026-103445 (opens in a new tab) CVE record for CVE-2026-103445 (opens in a new tab)
CVE-2026-103584 CVE-2026-103584: Unsafe license URLs in CommonsMetadata ADVISORY for CVE-2026-103584 (opens in a new tab) FIX for CVE-2026-103584 (opens in a new tab) CVE record for CVE-2026-103584 (opens in a new tab)
CVE-2026-103585 CVE-2026-103585: Stored XSS in MediaSearch QuickView ADVISORY for CVE-2026-103585 (opens in a new tab) FIX for CVE-2026-103585 (opens in a new tab) CVE record for CVE-2026-103585 (opens in a new tab)

Information disclosure

1
CVEWRITE-UPREFERENCES
CVE-2026-102971 CVE-2026-102971: REST compatibility exposed hidden revision authors ADVISORY for CVE-2026-102971 (opens in a new tab) CVE record for CVE-2026-102971 (opens in a new tab)

Information Disclosure

1
CVEWRITE-UPREFERENCES
CVE-2026-103440 CVE-2026-103440: PageTriage exposed suppressed reviewer usernames ADVISORY for CVE-2026-103440 (opens in a new tab) FIX for CVE-2026-103440 (opens in a new tab) CVE record for CVE-2026-103440 (opens in a new tab)

Deserialization

1
CVEWRITE-UPREFERENCES
CVE-2026-103441 CVE-2026-103441: Wikibase deserialization enabled file deletion and RCE ADVISORY for CVE-2026-103441 (opens in a new tab) FIX for CVE-2026-103441 (opens in a new tab) CVE record for CVE-2026-103441 (opens in a new tab)

Object Injection

1
CVEWRITE-UPREFERENCES
CVE-2026-103442 CVE-2026-103442: CentralAuth object injection and RCE ADVISORY for CVE-2026-103442 (opens in a new tab) FIX for CVE-2026-103442 (opens in a new tab) CVE record for CVE-2026-103442 (opens in a new tab)

.rsrc:tools

Tools

0 exports
00000000 <no public symbols>

Nothing released here yet. This slot is reserved for tools and scripts.

Resize column

Choose a width with the slider or the narrower and wider buttons.