Mario Madersbacher

About

I find bugs in software people actually use. npm packages, the tools this field runs on, web apps in bug bounty programs. Then I report them so they get fixed. I'm still in school, Matura is in June 2027.

I don't inflate severity. If there is a CVSS score on this page I demonstrated it, I didn't estimate it.

Research & disclosures

Three CVEs with me as the credited finder. The scores are what the CNA published, not my own numbers.

7.5^High

CVE-2026-103043 anchorme.js ≤ 3.0.8

ReDoS in the regex that pulls IPv6 hosts out of a URL, reachable through the default anchorme() call. A URL under 100 bytes makes it backtrack exponentially and the Node.js event loop just stops.

No fix released as of October 2026, npm latest is still 3.0.8. Credited under my real name on the CVE record.

CVE record VulnCheck advisory PoC gist

CVSS 7.5 v3.1 · 8.7 v4.0
CWE-1333 · Inefficient regular expression complexity
VulnCheck CNA · 29 Sept 2026

7.5^High

CVE-2026-90776 Nodemailer 9.1.0 to 10.0.4

The address parser in lib/addressparser goes quadratic on comment-joined addresses. Through mailparser that is reachable from outside with a normal inbound mail, no auth, and the event loop stalls for seconds.

Reported through a GitHub private advisory with a PoC and a fix suggestion. The maintainer patched it in 10.0.5. Credited on the advisory and on the CVE record.

GHSA-prgh-xp8r-p3m5 CVE record Fix commit

CVSS 7.5 v3.1 · 8.7 v4.0
CWE-407 · Inefficient algorithmic complexity
VulnCheck CNA · 13 Sept 2026

6.3^Medium

CVE-2026-90492 webgjc/web_robot 2.4.0 to 2.8.0

The case_name request parameter goes straight into os.system() in py/web.py (controller_listen and controller_recover), nothing is sanitised.

The vendor never answered, so it went out through VulDB. Credited as Telqrrr.

VulDB VDB-403080 CVE record

CVSS 6.3 v3.1 · 5.3 v4.0
CWE-78 · OS command injection
VulDB CNA · 13 Sept 2026

Open source

Bugs I ran into while reading the tools this field actually runs on. The fixes went upstream, not into forks of my own. 12 merged, 2 open, 8 projects. Every line is the pull request.

feroxbuster #1322 open If parallel came from a config file, every run died with an unwrap panic (#1321). Fix plus a regression test, Rust. ffuf #952 merged · 26 Sept 2026 Made the test suite pass on Windows. Three separate causes, one of them a pipe buffer deadlock in the stdout capture that only ever showed up as a hang. Scapy #5150 merged · 3 Sept 2026 The BGP NLRI dissector crashed when the prefix on the wire was shorter than the mask said. Scapy #5149 merged · 3 Sept 2026 IP6ListField crashed on a truncated last IPv6 address. That field sits in about 17 dissectors, DHCPv6, ICMPv6 and SRv6 among them. Impacket #2263 merged · 2 Sept 2026 BootpDecoder threw struct.error on BOOTP messages below the 300 octets RFC 1542 requires (#1900). Now handled the way the RFC says, with regression tests. LOLBAS #520 merged · 26 Aug 2026 Entry for Vssadmin.exe deleting shadow copies (MITRE T1490). Scapy #5096 merged · 26 Aug 2026 NSH MD-Type 2 context headers didn't dissect at all, count_from had been given a string. Redone along RFC 8300 with real length handling. Scapy #5095 merged · 26 Aug 2026 OPC DA: STDOBJREF.IPID and OpcDaFack.selack used field classes where packet classes belong, so dissecting them raised TypeError. Scapy #5094 merged · 26 Aug 2026 Bluetooth Set_Extended_Advertise_Enable always returned a single advertising set, no matter what num_sets said. Volatility 3 #2017 merged · 19 Aug 2026 The capabilities plugin broke on Linux kernels before 6.3. Fixed the structure handling. Volatility 3 #2016 merged · 19 Aug 2026 An architecture typo blocked scheduled_tasks on 32-bit memory images. Nuclei Templates #16902 merged · 19 Aug 2026 Template for CVE-2020-10204 (Nexus Repository Manager 3 RCE), verified against a live instance. Scapy #5090 merged · 16 Aug 2026 NBNS name query responses only gave back the first address record. Now every entry gets parsed. Sigma #6238 open Detection rule for Kerberos pre-auth getting disabled on a user account, which is exactly what AS-REP roasting needs.

Bug bounty

No program names here, that's the rule. The platform profiles are the record: HackerOne and YesWeHack.

High 7.5 C:H/I:N/A:N
accepted · rewarded An unauthenticated third-party proxy endpoint at a big European electronics retailer. It exposed around 9.1 M customer trade-in records, name, IMEI, contact, payout, across seven EU storefronts.

Government VDP
Belgium An internal Confluence that let anonymous users in (resolved). SQL injection in a public geo API (accepted). An open Grafana/Mimir/Loki stack with tenant enumeration (closed as informational).

Earliest
€300 My first one, an XSS chain on an Austrian price comparison site.

Projects

Own tools Rust, Go and Python, all on GitHub

IoTShade for network and IoT discovery, NetReconUltra, a Go scanner with a React dashboard, NetRecon in Python, and a hash cracker. I wrote them to understand how the real tools work.

Capture the flag

I play as Telqrrr, mostly with «Gehackt ist Geil», a small CTF community I started. If CTFtime tracks the event the rank links to the scoreboard. Two results only exist on the platform's own board and say so.

3^rd

BrunnerCTF 2026

Jeopardy · 23 Aug 2026 · team

of 1,102 teams

2^nd

MntcrlCTF 2026

Jeopardy · 28 Jun 2026 · team

of 118 teams

37^th

SAS CTF 2026 Quals

Qualifier · 7 Jun 2026 · team

of 515 teams

14^th

HTB Cyber Apocalypse 2026

Jeopardy · 2026 · HTB scoreboard, not on CTFtime

team of 3 · several thousand teams

2^nd

TryHackMe AI Odyssey CTF

Jeopardy · 2026 · TryHackMe scoreboard, not on CTFtime

worldwide

Certifications

Hack The Box · 7 Oct 2026 HTB Certified Web Exploitation Specialist (CWES). 100 of 100 points in the exam. HTBCERT-BB6F9B6B7A

TryHackMe · Jun 2026 Junior Penetration Tester (PT1). Valid to June 2029.

TryHackMe · Jun 2026 AI Security (AI1). Valid to June 2029.

Skills

Web & API Burp SuiteOWASP Top 10GraphQLRESTffufsqlmapReDoS / algorithmic DoS

Network & AD nmapImpacketScapyKerberosLDAP / SMBVLANs

Detection & defense WazuhMITRE ATT&CKSysmonCIS Benchmarksvulnerability management

Code & tooling PythonRustTypeScriptBashDockerGitGhidra / BinDiff

Reporting CVSS v3.1 / v4CWEcoordinated disclosurepentest reports

Languages German (native)English (B2)

Contact

Vetting my application, triaging one of my reports, or you've got a target worth a weekend: mario.madersbacher.2008@gmail.com. I'm also on GitHub, HackerOne, YesWeHack, LinkedIn.

Tyrol, Austria. PGP on request. Anything about this site itself goes to security.txt.