Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Tools/GitHubGitHub/nabeelmkhan/cve-2026-78837
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingDatabase Security
GitHubnabeelmkhan/cve-2026-78837

CVE-2026-78837

Proof-of-concept exploit for CVE-2026-78837, an unauthenticated SQL injection in AppNitro MachForm v30 allowing enumeration of database column names via crafted filter parameters.

View Repository
10h 28m agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-78837

Description

An SQL injection vulnerability in the ap_form_{id} parameter in AppNitro MachForm v30 allows attackers to access sensitive database information via a crafted SQL statement.

Affected Component

Tested on MachForm - Version 30

Attack Type

Remote

Attack Vectors

An unauthenticated attacker can inject into the filter[filters][0][field] parameter in grid_datasource.php to enumerate valid column names in the ap_form_{id} table.

Risk

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P (6.9 / Medium)

Reference

https://<application-baseurl>/grid_datasource.php?key={form_id}x{widget_key}&filter[filters][0][field]=element_1&filter[filters][0][operator]=contains&filter[filters][0][value]=%25

Researcher

Nabeel Khan - NCCGroup

Download Tool