TI-2021-03404 Aliases CVE-2021-20104 GHSA-2gq4-6723-j8cq

Unrestricted file upload in AppNitro Machform

LOW 39CWE-434Published 2021-06-29 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-434.

Summary

Machform prior to version 16 is vulnerable to unauthenticated remote code execution due to insufficient sanitization of file attachments uploaded with forms through upload.php.

Why it matters now

EPSS 0.02168 82nd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	AppNitro Machform	All versions prior to version 16	—	No fix listed	CNA

AppNitro Machform Vendor— Affected All versions prior to version 16 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:machform:machform::::::::	before 16	Vulnerable	Machform

cpe:2.3:a:machform:machform:*:*:*:*:*:*:*:* Versions before 16 Vulnerable ·Machform

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2021-20104
2026-10-03 Alias added: GHSA-2gq4-6723-j8cq

References

Other 1

https://www.tenable.com/security/research/tra-2021-25%2Chttps://www.machform.com/blog-machform-16-released/

TI-2024-25139 Machform up to version 19 is affected by an authenticated Blind SQL injection in the user account settings page. CVSS 3.1HIGH 8.8
TI-2024-25136 MachForm up to version 21 is affected by an authenticated unrestricted file upload which… CVSS 3.1CRITICAL 9.9
TI-2024-25138 MachForm up to version 19 is affected by an authenticated stored cross-site scripting. CVSS 3.1MEDIUM 5.4
TI-2024-25137 MachForm up to version 19 is affected by an unauthenticated stored cross-site scripting… CVSS 3.1MEDIUM 5.4
TI-2018-04724 An issue was discovered in Appnitro MachForm before 4.2.3. CVSS 3.0CRITICAL 9.8
TI-2018-04723 An issue was discovered in Appnitro MachForm before 4.2.3. CVSS 3.0CRITICAL 9.8

See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences