nabeelmkhan/cve-2026-78838Repository dedicated to CVE-2026-78838, providing analysis and potential proof-of-concept for the vulnerability.
A reflected cross-site scripting (XSS) vulnerability in the grid_datasource.php component of AppNitro MachForm v30 allows attackers to execute arbitrary Javascript in the context of the victim's browser via injecting a crafted payload into the filter[filters][0][field] parameter.
An unauthenticated attacker can leverage SQL error messages in grid_datasource.php to execute arbitrary JavaScript in the victim's browser.
Tested on Machform - version 30
Remote
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P (5.0/Medium)
https://<application-base-url>/grid_datasource.php?key={key}&filter[filters][0][field]=&filter[filters][0][operator]=contains&filter[filters][0][value]=<script>JS</script>
Nabeel Khan - NCCGroup
