CVE-2026-78838

Description

A reflected cross-site scripting (XSS) vulnerability in the grid_datasource.php component of AppNitro MachForm v30 allows attackers to execute arbitrary Javascript in the context of the victim's browser via injecting a crafted payload into the filter[filters][0][field] parameter.

Attack Vectors

An unauthenticated attacker can leverage SQL error messages in grid_datasource.php to execute arbitrary JavaScript in the victim's browser.

Affected Component

Tested on Machform - version 30

Attack Type

Remote

Risk

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P (5.0/Medium)

PoC

https://<application-base-url>/grid_datasource.php?key={key}&filter[filters][0][field]=&filter[filters][0][operator]=contains&filter[filters][0][value]=<script>JS</script>

Evidence

Researcher

Nabeel Khan - NCCGroup