CVE-2026-78838: XSS
A reflected cross-site scripting (XSS) vulnerability in the griddatasource.php component of AppNitro MachForm v30 allows attackers to execute arbitrary Javascript in the context of the victim's browser via injecting a crafted payload into the filter[filters][0][field] parameter.
Affected Software
Event History
Frequently Asked Questions
Which installations should be prioritized for investigation?
Prioritize installations of AppNitro MachForm v30, as that is the affected product and version identified in the available information.
What request data is relevant when looking for exploitation attempts?
Review requests to grid_datasource.php for the filter[filters][0][field] parameter. Crafted payloads supplied through that parameter are the described exploitation vector.
What is the practical impact if exploitation succeeds?
An attacker can execute arbitrary JavaScript in the context of the victim's browser. The impact therefore occurs in the affected user's browser session rather than being described as direct server-side code execution.