cve-2024-37762

Description MachForm up to version 21 is affected by an authenticated unrestricted file upload which leads to a remote code execution. The application offers the possibility of a creation of a form with a file upload functionality. While by default the accepted files are restricted to a common sa...

cve-2024-37763

Description MachForm up to version 19 is affected by an unauthenticated stored cross-stie scripting which affects users with valid sessions whom can view compiled forms results. In target web application, when using a form with text signature enabled, the request made to the vulnerable resource h...

cve-2024-37764

Description MachForm up to version 19 is affected by an authenticated stored cross-stie scripting. In target web application, the request made to the vulnerable resource has been found to be suffering from XSS attack. Parameters of the body's POST request inside vulnerable URL lacks sanitization,...

cve-2024-37765

Description MachForm up to version 19 is affected by an authenticated Blind SQL injection in the user account settings page. SQL injection attacks consist in inserting SQL queries through the usage of an input data field from the client application. This kind of attack allows to obtain access to...

CVE-2026-78839

CVE-2026-78839 Description An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar file. Successful exploitation of this issue requires two practical caveats. First, an attacker must either identify an existing form...

CVE-2026-78837

CVE-2026-78837 Description An SQL injection vulnerability in the apformid parameter in AppNitro MachForm v30 allows attackers to access sensitive database information via a crafted SQL statement. Affected Component Tested on MachForm - Version 30 Attack Type Remote Attack Vectors An unauthenticat...

CVE-2026-78837

A SQL injection vulnerability in the apformid parameter in AppNitro MachForm v30 allows attackers to access sensitive database information via a crafted SQL statement...

CVE-2026-78838

A reflected cross-site scripting XSS vulnerability in the griddatasource.php component of AppNitro MachForm v30 allows attackers to execute arbitrary Javascript in the context of the victim's browser via injecting a crafted payload into the filterfilters0field parameter...

CVE-2026-78837

AppNitro MachForm v30 contains a remote SQL injection vulnerability in the filter[filters][0][field] parameter of grid_datasource.php. An unauthenticated attacker can inject a crafted SQL statement to enumerate valid column names in the ap_form_{id} table, gaining access to sensitive database inf...

EUVD-2026-72851

A SQL injection vulnerability in the apformid parameter in AppNitro MachForm v30 allows attackers to access sensitive database information via a crafted SQL statement...

CVE-2026-78837

A SQL injection vulnerability in the apformid parameter in AppNitro MachForm v30 allows attackers to access sensitive database information via a crafted SQL statement...

CVE-2026-78838

A reflected cross-site scripting XSS vulnerability in the griddatasource.php component of AppNitro MachForm v30 allows attackers to execute arbitrary Javascript in the context of the victim's browser via injecting a crafted payload into the filterfilters0field parameter...

CVE-2026-78838

AppNitro MachForm v30 contains a reflected XSS in the grid_datasource.php component, triggered by injecting a crafted payload into the filter[filters][0][field] parameter. An unauthenticated remote attacker can execute arbitrary JavaScript in the victim's browser. The vulnerability was rated CVSS...

EUVD-2026-72775

A reflected cross-site scripting XSS vulnerability in the griddatasource.php component of AppNitro MachForm v30 allows attackers to execute arbitrary Javascript in the context of the victim's browser via injecting a crafted payload into the filterfilters0field parameter...

CVE-2026-78839

An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar file...

CVE-2026-78839

An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar file...

EUVD-2026-71712

An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar file...

CVE-2026-78839

AppNitro MachForm v30 is affected by an arbitrary file upload vulnerability that can lead to remote code execution via a crafted .phar file. Exploitation requires two prerequisites: a form configured to permit .phar uploads, and brute-forcing the random MD5 hash filename to retrieve the uploaded ...

AppNitro MachForm 30 Cross Site Scripting

AppNitro MachForm version 30 suffers from a cross site scripting vulnerability. CVE-2026-78838 Description A reflected cross-site scripting XSS vulnerability in the griddatasource.php component of AppNitro MachForm v30 allows attackers to execute arbitrary Javascript in the context of the victim'...

AppNitro MachForm 30 SQL Injection

AppNitro MachForm version 30 suffers from a remote SQL injection vulnerability. CVE-2026-78837 Description An SQL injection vulnerability in the apformid parameter in AppNitro MachForm v30 allows attackers to access sensitive database information via a crafted SQL statement. Affected Component...