CVE-2026-78838

MediumCVSS 6.5

Published: 08/09/2026(UTC)Updated: 09/09/2026(UTC)Translated: 08/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

30th percentile - higher than 30% of all known CVEs

Summary

A reflected cross-site scripting (XSS) vulnerability in the grid_datasource.php component of AppNitro MachForm v30 allows attackers to execute arbitrary JavaScript in the context of the victim's browser via injecting a crafted payload into the filter[filters][0][field] parameter.

Risk Assessment

An attacker could steal credentials, hijack user sessions, or perform other malicious actions in the context of a logged-in user, potentially leading to data confidentiality and integrity compromise.

Recommendation

Update MachForm to a patched version if available and validate/sanitize input in the filter[filters][0][field] parameter.

Other vulnerabilities in AppNitro MachForm

CVE-2026-78837High
A SQL injection vulnerability in the ap_form_{id} parameter in AppNitro MachForm v30 allows attackers to access sensitive database information via a crafted SQL statement.

Original NVD description (English source)

A reflected cross-site scripting (XSS) vulnerability in the grid_datasource.php component of AppNitro MachForm v30 allows attackers to execute arbitrary Javascript in the context of the victim's browser via injecting a crafted payload into the filter[filters][0][field] parameter.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS