CVE-2026-78838

Deferred Deferred - Pending Action

Reflected XSS in AppNitro MachForm v30

Publication date: 2026-09-08

Last updated on: 2026-09-09

Assigner: MITRE

Description

A reflected cross-site scripting (XSS) vulnerability in the grid_datasource.php component of AppNitro MachForm v30 allows attackers to execute arbitrary Javascript in the context of the victim's browser via injecting a crafted payload into the filter[filters][0][field] parameter.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-09

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-78838

Affected Vendors & Products

Vendor	Product	Version / Range
appnitro	machform	30

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a reflected cross-site scripting (XSS) vulnerability in AppNitro MachForm v30. It allows attackers to inject malicious JavaScript code into the grid_datasource.php component by exploiting the filter[filters][0][field] parameter. The injected script executes in the victim's browser when they access a crafted URL.

Detection Guidance

To detect this vulnerability, monitor network traffic for unusual requests to grid_datasource.php with the filter[filters][0][field] parameter containing JavaScript payloads. Check server logs for reflected XSS attempts in error messages from MachForm v30.

Impact Analysis

An attacker could steal sensitive data like session cookies, redirect you to malicious sites, or perform actions on your behalf without your knowledge. Since it requires user interaction (clicking a malicious link), the risk depends on whether you click untrusted links.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR (data protection) and HIPAA (health data privacy) requirements. Organizations using MachForm v30 may face compliance breaches if exploited, potentially resulting in fines or legal consequences.

Mitigation Strategies

Immediately update MachForm to the latest patched version. If an update is unavailable, restrict access to grid_datasource.php via web server rules and implement input validation to block JavaScript payloads in the filter[filters][0][field] parameter.

Hi! I’m here to help you understand CVE-2026-78838. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70