AppNitro MachForm 30 Cross Site Scripting

# CVE-2026-78838
    
    ## Description
    A reflected cross-site scripting (XSS) vulnerability in the `grid_datasource.php` component of AppNitro MachForm v30 allows attackers to execute arbitrary Javascript in the context of the victim's browser via injecting a crafted payload into the `filter[filters][0][field]` parameter.
    
    ## Attack Vectors
    An unauthenticated attacker can leverage SQL error messages in `grid_datasource.php` to execute arbitrary JavaScript in the victim's browser.
    
    ## Affected Component
    Tested on Machform - version 30
    
    ## Attack Type
    Remote
    
    ## Risk
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P (5.0/Medium)
    
    ## PoC
    `https://<application-base-url>/grid_datasource.php?key={key}&filter[filters][0][field]=&filter[filters][0][operator]=contains&filter[filters][0][value]=<script>JS</script>`
    
    ## Evidence
    <img width="946" height="229" alt="image" src="https://github.com/user-attachments/assets/2e1c9c0f-5ceb-48fd-8791-e11f229f9b4f" />
    
    ## Researcher
    Nabeel Khan - NCCGroup