Machform

15 CVEs across 1 Machform products. Browse Machform vulnerabilities, severities, and proof-of-concept exploits.

Machform products with known CVEs

ProductCVEs
Machform15
Machform CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2024-37765High8.82024-07-01Machform up to version 19 is affected by an authenticated Blind SQL injection in the user account settings page.
CVE-2024-37764Medium5.42024-07-01MachForm up to version 19 is affected by an authenticated stored cross-site scripting.
CVE-2024-37763Medium5.42024-07-01MachForm up to version 19 is affected by an unauthenticated stored cross-site scripting which affects users with valid sessions whom can view compiled forms re…
CVE-2024-37762Critical9.92024-07-01MachForm up to version 21 is affected by an authenticated unrestricted file upload which leads to a remote code execution.
CVE-2021-20105Medium6.12021-06-29Machform prior to version 16 is vulnerable to an open redirect in Safari_init.php due to an improperly sanitized 'ref' parameter.
CVE-2021-20104High8.12021-06-29Machform prior to version 16 is vulnerable to unauthenticated remote code execution due to insufficient sanitization of file attachments uploaded with forms th…
CVE-2021-20103Medium6.12021-06-29Machform prior to version 16 is vulnerable to stored cross-site scripting due to insufficient sanitization of file attachments uploaded with forms through uplo…
CVE-2021-20102High8.82021-06-29Machform prior to version 16 is vulnerable to cross-site request forgery due to a lack of CSRF tokens in place.
CVE-2021-20101Medium6.12021-06-29Machform prior to version 16 is vulnerable to HTTP host header injection due to improperly validated host headers. This could cause a victim to receive malform…
CVE-2018-6411Critical9.82018-05-26An issue was discovered in Appnitro MachForm before 4.2.3. When the form is set to filter a blacklist, it automatically adds dangerous extensions to the filter…
CVE-2018-6410Critical9.82018-05-26An issue was discovered in Appnitro MachForm before 4.2.3. There is a download.php SQL injection via the q parameter.
CVE-2018-6409Medium5.32018-05-26An issue was discovered in Appnitro MachForm before 4.2.3. The module in charge of serving stored files gets the path from the database. Modifying the name of…
CVE-2013-49502013-07-29Cross-site scripting (XSS) vulnerability in view.php in Machform 2 allows remote attackers to inject arbitrary web script or HTML via the element_2 parameter.
CVE-2013-49492013-07-29Unrestricted file upload vulnerability in view.php in Machform 2 allows remote attackers to execute arbitrary PHP code by uploading a PHP file, then accessing…
CVE-2013-49482013-07-29SQL injection vulnerability in view.php in Machform 2 allows remote attackers to execute arbitrary SQL commands via the element_2 parameter.