PT-2024-27737 · Machform · Machform

Name of the Vulnerable Software and Affected Versions: Machform versions prior to 20 Description: The issue is related to an authenticated Blind SQL injection in the user account settings page. Recommendations: For versions prior to 20, update to version 20 or later to resolve the issue...

PT-2024-27736 · Machform · Machform

Name of the Vulnerable Software and Affected Versions: MachForm versions prior to 20 Description: The issue is an authenticated stored cross-site scripting problem. Recommendations: For versions prior to 20, update to version 20 or later to resolve the issue...

Machform Security Vulnerabilities

Machform is an online questionnaire program. A security vulnerability exists in Machform version 21 and prior versions, which stems from being affected by an authenticated unrestricted file upload and can lead to remote code execution...

CVE-2024-37762: Unrestricted Upload of File with Dangerous Type

MachForm up to version 21 is affected by an authenticated unrestricted file upload which leads to a remote code execution...

CVE-2024-37764: Improper Neutralization of Input During Web Page Generation

MachForm up to version 19 is affected by an authenticated stored cross-site scripting...

CVE-2024-37763: Improper Neutralization of Input During Web Page Generation

MachForm up to version 19 is affected by an unauthenticated stored cross-site scripting which affects users with valid sessions whom can view compiled forms results...

Machform Security Vulnerabilities

Machform is an online questionnaire program. A security vulnerability exists in Machform version 19 and prior versions that originates from an authenticated blind SQL injection in the user account settings page...

CVE-2024-37764

MachForm up to version 19 is affected by an authenticated stored cross-site scripting...

CVE-2024-37762

MachForm up to version 21 is affected by an authenticated unrestricted file upload which leads to a remote code execution...

CVE-2024-37765

Machform versions up to v19 are vulnerable to an authenticated Blind SQL injection located on the user account settings page (my_account.php). The root cause is the improper neutralization of special elements in the _user_admin_theme parameter, allowing an attacker to inject SQL queries. Exploita...

CVE-2024-37762

MachForm versions up to v21 are vulnerable to an authenticated unrestricted file upload that can lead to remote code execution (RCE) . The root cause exists because the application allows form creators to specify additional allowed file formats beyond the default safe set. If a user with form cre...

Machform upload.php Data Compromise

The vulnerability in the upload.php PHP form builder of Machform exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality and integrity of the protected information...

Machform form creation PHP editor XSS

The vulnerability in the Safariinit.php function of the Machform form creation PHP editor is related to the use of open redirection. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of the protected information...

Machform upload.php Code Execution

The vulnerability in the upload.php function of the Machform form editor PHP editor relates to the lack of restrictions on file uploads. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Machform Remote Code Execution Vulnerability

MachForm is an HTML form builder that lets you create contact forms, surveys, order forms or any other web form without writing code. A remote code execution vulnerability exists in versions prior to Machform 16. The vulnerability stems from insufficient validation of file attachments uploaded wi...

Machform Cross-Site Request Forgery Vulnerability

MachForm is an HTML form builder that lets you create contact forms, surveys, order forms or any other web form without writing code. A cross-site request forgery CSRF vulnerability exists in versions prior to Machform 16. The vulnerability stems from a missing CSRF token. An attacker can exploit...

Machform Cross-Site Scripting Vulnerability

MachForm is an HTML form builder that lets you create contact forms, surveys, order forms or any other web form without writing code. A stored cross-site scripting vulnerability exists in versions prior to Machform 16. The vulnerability stems from insufficient validation of file attachments...

Machform HTTP Host Header Injection Vulnerability

MachForm is an HTML form builder that lets you create contact forms, surveys, order forms or any other web form without writing code. An HTTP host header injection vulnerability exists in versions prior to Machform 16. The vulnerability stems from improper validation of the host header. An attack...

Machform Open Redirect Vulnerability

MachForm is an HTML form builder that lets you create contact forms, surveys, order forms or any other web form without writing code. An open redirect vulnerability exists in Safariinit.php in versions prior to Machform 16. The vulnerability stems from improper validation of the ref parameter. An...

CVE-2021-20103

Machform prior to version 16 is vulnerable to stored cross-site scripting due to insufficient sanitization of file attachments uploaded with forms through upload.php...