Machform

Records15All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high4CVSS 7.0–8.9

Exploited now

Machform records in CISA KEV

No Machform vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Machform 15 records HIGH

Records

15 records

TI-2024-25139 CVE-2024-37765 · GHSA-f969-h37g-7mjc

Machform up to version 19 is affected by an authenticated Blind SQL injection in the user account settings page.

HIGH 79

Machform up to version 19 is affected by an authenticated Blind SQL injection in the user account settings page.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00831 Published 2024-07-01 No fix listed CWE-89

TI-2024-25136 CVE-2024-37762 · GHSA-hhqh-cfwm-qf6m

MachForm up to version 21 is affected by an authenticated unrestricted file upload which…

HIGH 76

MachForm up to version 21 is affected by an authenticated unrestricted file upload which leads to a remote code execution.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.01457 Published 2024-07-01 No fix listed CWE-434

TI-2024-25138 CVE-2024-37764 · GHSA-ghf9-pcm2-m9h8

MachForm up to version 19 is affected by an authenticated stored cross-site scripting.

MEDIUM 58

MachForm up to version 19 is affected by an authenticated stored cross-site scripting.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00588 Published 2024-07-01 No fix listed CWE-79

TI-2024-25137 CVE-2024-37763 · GHSA-pp72-6x86-58pw

MachForm up to version 19 is affected by an unauthenticated stored cross-site scripting…

MEDIUM 58

MachForm up to version 19 is affected by an unauthenticated stored cross-site scripting which affects users with valid sessions whom can view compiled forms results.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00672 Published 2024-07-01 No fix listed CWE-79

TI-2018-04724 CVE-2018-6411 · GHSA-cj4v-rh8v-p7c7

An issue was discovered in Appnitro MachForm before 4.2.3.

MEDIUM 50

An issue was discovered in Appnitro MachForm before 4.2.3.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.05498 Published 2018-05-26 No fix listed CWE-434

TI-2018-04723 CVE-2018-6410 · GHSA-ph64-vv6r-8php

An issue was discovered in Appnitro MachForm before 4.2.3.

MEDIUM 50

An issue was discovered in Appnitro MachForm before 4.2.3.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.04649 Published 2018-05-26 No fix listed CWE-89

TI-2021-03404 CVE-2021-20104 · GHSA-2gq4-6723-j8cq

Unrestricted file upload in AppNitro Machform

LOW 39

Machform prior to version 16 is vulnerable to unauthenticated remote code execution due to insufficient sanitization of file attachments uploaded with forms through upload.php.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.02168 Published 2021-06-29 No fix listed CWE-434

TI-2021-03402 CVE-2021-20102 · GHSA-hwqv-mgvv-f7g4

Machform prior to version 16 is vulnerable to cross-site request forgery due to a lack of CSRF tokens in place.

LOW 39

Machform prior to version 16 is vulnerable to cross-site request forgery due to a lack of CSRF tokens in place.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00512 Published 2021-06-29 No fix listed CWE-352

TI-2018-04722 CVE-2018-6409 · GHSA-7m97-g8f2-fj9g

An issue was discovered in Appnitro MachForm before 4.2.3.

LOW 39

An issue was discovered in Appnitro MachForm before 4.2.3.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.13832 Published 2018-05-26 No fix listed CWE-22

TI-2013-04328 CVE-2013-4948 · GHSA-pmc4-m2mx-j46r

SQL injection vulnerability in view.php in Machform 2 allows remote attackers to execute…

LOW 39

SQL injection vulnerability in view.php in Machform 2 allows remote attackers to execute arbitrary SQL commands via the element_2 parameter.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03456 Published 2013-07-29 No fix listed CWE-89

TI-2013-04329 CVE-2013-4949 · GHSA-mj66-8p4w-7w6w

Unrestricted file upload vulnerability in view.php in Machform 2 allows remote attackers…

LOW 38

Unrestricted file upload vulnerability in view.php in Machform 2 allows remote attackers to execute arbitrary PHP code by uploading a PHP file, then accessing it via a direct request to the file in the upload form's dire…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.05453 Published 2013-07-29 No fix listed

TI-2021-03405 CVE-2021-20105 · GHSA-387w-v9hj-ph2g

Open redirect in AppNitro Machform

LOW 29

Machform prior to version 16 is vulnerable to an open redirect in Safari_init.php due to an improperly sanitized 'ref' parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00744 Published 2021-06-29 No fix listed CWE-601

TI-2021-03403 CVE-2021-20103 · GHSA-89p7-qxqf-9q7p

Cross-site scripting in AppNitro Machform

LOW 28

Machform prior to version 16 is vulnerable to stored cross-site scripting due to insufficient sanitization of file attachments uploaded with forms through upload.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00685 Published 2021-06-29 No fix listed CWE-79

TI-2021-03401 CVE-2021-20101 · GHSA-83r5-mv86-2rcp

Injection in AppNitro Machform

LOW 28

Machform prior to version 16 is vulnerable to HTTP host header injection due to improperly validated host headers.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00722 Published 2021-06-29 No fix listed CWE-74

TI-2013-04330 CVE-2013-4950 · GHSA-qvxq-grv7-37f5

Cross-site scripting (XSS) vulnerability in view.php in Machform 2 allows remote…

LOW 27

Cross-site scripting (XSS) vulnerability in view.php in Machform 2 allows remote attackers to inject arbitrary web script or HTML via the element_2 parameter.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.03889 Published 2013-07-29 No fix listed CWE-79

Open these records in search →

Critical	3
High	4
Medium	8
Low	0
No CVSS	0