CVE-2026-78837

HighCVSS 7.5

Published: 08/09/2026(UTC)Updated: 09/09/2026(UTC)Translated: 08/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

24th percentile - higher than 24% of all known CVEs

Summary

A SQL injection vulnerability in the ap_form_{id} parameter in AppNitro MachForm v30 allows attackers to access sensitive database information via a crafted SQL statement.

Risk Assessment

An attacker can exploit the vulnerability to read, modify, or delete database data, potentially leading to data confidentiality and integrity compromise.

Recommendation

Immediately update MachForm to a patched version and use parameterized SQL queries.

Other vulnerabilities in AppNitro MachForm

CVE-2026-78838Medium
A reflected cross-site scripting (XSS) vulnerability in the grid_datasource.php component of AppNitro MachForm v30 allows attackers to execute arbitrary JavaScript in the context of the victim's browser via injecting a crafted payload into the filter[filters][0][field] parameter.

Original NVD description (English source)

A SQL injection vulnerability in the ap_form_{id} parameter in AppNitro MachForm v30 allows attackers to access sensitive database information via a crafted SQL statement.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS