CVE-2018-6410: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in Appnitro MachForm before 4.2.3. There is a download.php SQL injection via the q parameter...

CVE-2018-6409: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in Appnitro MachForm before 4.2.3. The module in charge of serving stored files gets the path from the database. Modifying the name of the file to serve on the corresponding apform table leads to a path traversal vulnerability via the download.php q parameter...

CVE-2018-6411: Unrestricted Upload of File with Dangerous Type

An issue was discovered in Appnitro MachForm before 4.2.3. When the form is set to filter a blacklist, it automatically adds dangerous extensions to the filters. If the filter is set to a whitelist, the dangerous extensions can be bypassed through apformelements SQL Injection...

Machform Form Maker 2 - Multiple Vulnerabilities

No description provided by source...

CVE-2013-4950

Cross-site scripting XSS vulnerability in view.php in Machform 2 allows remote attackers to inject arbitrary web script or HTML via the element2 parameter...

CVE-2013-4949

Unrestricted file upload vulnerability in view.php in Machform 2 allows remote attackers to execute arbitrary PHP code by uploading a PHP file, then accessing it via a direct request to the file in the upload form's directory in data/...

CVE-2013-4948

SQL injection vulnerability in view.php in Machform 2 allows remote attackers to execute arbitrary SQL commands via the element2 parameter...

Sql injection

SQL injection vulnerability in view.php in Machform 2 allows remote attackers to execute arbitrary SQL commands via the element2 parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in view.php in Machform 2 allows remote attackers to inject arbitrary web script or HTML via the element2 parameter...

Unrestricted file upload

Unrestricted file upload vulnerability in view.php in Machform 2 allows remote attackers to execute arbitrary PHP code by uploading a PHP file, then accessing it via a direct request to the file in the upload form's directory in data/...

CVE-2013-4949

Unrestricted file upload vulnerability in view.php in Machform 2 allows remote attackers to execute arbitrary PHP code by uploading a PHP file, then accessing it via a direct request to the file in the upload form's directory in data/...

CVE-2013-4948

SQL injection vulnerability in view.php in Machform 2 allows remote attackers to execute arbitrary SQL commands via the element2 parameter...

CVE-2013-4950

CVE-2013-4950 describes a cross-site scripting (XSS) vulnerability in Machform 2, specifically in the file/view handler view.php . The issue allows remote attackers to inject arbitrary web script or HTML by submitting input in the element_2 parameter. The provided documents do not specify affecte...

CVE-2013-4950

Cross-site scripting XSS vulnerability in view.php in Machform 2 allows remote attackers to inject arbitrary web script or HTML via the element2 parameter...

CVE-2013-4948

The CVE-2013-4948 entry details a SQL injection in Machform 2’s view.php, exploitable via the element_2 parameter. This allows remote attackers to execute arbitrary SQL commands, with a CVSS v2 base score of 7.5 (HIGH). The affected software and exact vulnerable component are Machform 2, specific...

CVE-2013-4949

CVE-2013-4949 affects MachForm 2, specifically an unrestricted file upload vulnerability in view.php. An attacker can upload a PHP file and access it in the upload directory (data/), allowing remote code execution. The NVD summary cites MachForm 2 as vulnerable to arbitrary PHP execution via a cr...

CVE-2013-4948: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in view.php in Machform 2 allows remote attackers to execute arbitrary SQL commands via the element2 parameter...

CVE-2013-4950: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in view.php in Machform 2 allows remote attackers to inject arbitrary web script or HTML via the element2 parameter...

CVE-2013-4949: Undefined Security Weakness

Unrestricted file upload vulnerability in view.php in Machform 2 allows remote attackers to execute arbitrary PHP code by uploading a PHP file, then accessing it via a direct request to the file in the upload form's directory in data/...

Machform Form Maker 2 XSS / Shell Upload / SQL Injection

Exploit Title: Machform form maker - Multiple Vulnerabilities Date: 2013 17 June Exploit Author: Yashar shahinzadeh Credit goes for: ha.cker.ir Vendor Homepage: http://www.appnitro.com Tested on: Linux & Windows, PHP 5.2.9 Affected Version : 2 Special thanks to: Mormoroth Dork1: "Powered by...