{"id":"CVE-2026-78838","title":"A reflected cross-site scripting (XSS) vulnerability in the grid_datasource.php component of AppNitro MachForm v30 allows attackers to execute arbitrary Javascript in the context of the victim's browser via injecting a crafted payload in…","summary":"A reflected cross-site scripting (XSS) vulnerability in the grid_datasource.php component of AppNitro MachForm v30 allows attackers to execute arbitrary Javascript in the context of the victim's browser via injecting a crafted payload in…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","cwe":["CWE-79"],"published":"2026-09-08","updated":"2026-09-09","sourceUpdated":"2026-09-09T20:20:42.387","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-78838","references":[{"url":"https://github.com/nabeelmkhan/CVE-2026-78838","label":"cve@mitre.org"},{"url":"https://packetstormsecurity.com","label":"cve@mitre.org"},{"url":"https://github.com/nabeelmkhan/CVE-2026-78838","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-09T19:47:31.710636Z"},"epss":0.00389,"epssPercentile":0.30138,"exploits":{"github":1,"githubRepos":["https://github.com/nabeelmkhan/CVE-2026-78838"],"checkedAt":"2026-09-25T08:21:14.629Z"},"ingestedAt":"2026-09-08T15:33:26.985Z","slug":"CVE-2026-78838","body":"## Overview\n\nA reflected cross-site scripting (XSS) vulnerability in the grid_datasource.php component of AppNitro MachForm v30 allows attackers to execute arbitrary Javascript in the context of the victim's browser via injecting a crafted payload into the filter[filters][0][field] parameter.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":201948,"id":"CVE-2026-78838","ts":1789399993206,"field":"cvss","old":null,"new":"6.5"},{"seq":201947,"id":"CVE-2026-78838","ts":1789399993206,"field":"severity","old":"none","new":"medium"},{"seq":200678,"id":"CVE-2026-78838","ts":1789397585342,"field":"cvss","old":"6.5","new":null},{"seq":200677,"id":"CVE-2026-78838","ts":1789397585342,"field":"severity","old":"medium","new":"none"},{"seq":199385,"id":"CVE-2026-78838","ts":1789395475378,"field":"cvss","old":null,"new":"6.5"},{"seq":199384,"id":"CVE-2026-78838","ts":1789395475378,"field":"severity","old":"none","new":"medium"},{"seq":198630,"id":"CVE-2026-78838","ts":1789392188073,"field":"cvss","old":"6.5","new":null},{"seq":198629,"id":"CVE-2026-78838","ts":1789392188073,"field":"severity","old":"medium","new":"none"},{"seq":196961,"id":"CVE-2026-78838","ts":1789384273009,"field":"cvss","old":null,"new":"6.5"},{"seq":196960,"id":"CVE-2026-78838","ts":1789384273009,"field":"severity","old":"none","new":"medium"},{"seq":194092,"id":"CVE-2026-78838","ts":1789378693719,"field":"cvss","old":"6.5","new":null},{"seq":194091,"id":"CVE-2026-78838","ts":1789378693719,"field":"severity","old":"medium","new":"none"},{"seq":192879,"id":"CVE-2026-78838","ts":1789376494295,"field":"cvss","old":null,"new":"6.5"},{"seq":192878,"id":"CVE-2026-78838","ts":1789376494295,"field":"severity","old":"none","new":"medium"},{"seq":191666,"id":"CVE-2026-78838","ts":1789373590261,"field":"cvss","old":"6.5","new":null},{"seq":191665,"id":"CVE-2026-78838","ts":1789373590261,"field":"severity","old":"medium","new":"none"},{"seq":190451,"id":"CVE-2026-78838","ts":1789369449360,"field":"cvss","old":null,"new":"6.5"},{"seq":190450,"id":"CVE-2026-78838","ts":1789369449360,"field":"severity","old":"none","new":"medium"},{"seq":189238,"id":"CVE-2026-78838","ts":1789368373293,"field":"cvss","old":"6.5","new":null},{"seq":189237,"id":"CVE-2026-78838","ts":1789368373293,"field":"severity","old":"medium","new":"none"},{"seq":188021,"id":"CVE-2026-78838","ts":1789365211364,"field":"cvss","old":null,"new":"6.5"},{"seq":188020,"id":"CVE-2026-78838","ts":1789365211364,"field":"severity","old":"none","new":"medium"},{"seq":186808,"id":"CVE-2026-78838","ts":1789363454832,"field":"cvss","old":"6.5","new":null},{"seq":186807,"id":"CVE-2026-78838","ts":1789363454832,"field":"severity","old":"medium","new":"none"},{"seq":185594,"id":"CVE-2026-78838","ts":1789361195090,"field":"cvss","old":null,"new":"6.5"},{"seq":185593,"id":"CVE-2026-78838","ts":1789361195090,"field":"severity","old":"none","new":"medium"},{"seq":184381,"id":"CVE-2026-78838","ts":1789358318817,"field":"cvss","old":"6.5","new":null},{"seq":184380,"id":"CVE-2026-78838","ts":1789358318817,"field":"severity","old":"medium","new":"none"},{"seq":182632,"id":"CVE-2026-78838","ts":1789354302434,"field":"cvss","old":null,"new":"6.5"},{"seq":182631,"id":"CVE-2026-78838","ts":1789354302434,"field":"severity","old":"none","new":"medium"},{"seq":181425,"id":"CVE-2026-78838","ts":1789353279950,"field":"cvss","old":"6.5","new":null},{"seq":181424,"id":"CVE-2026-78838","ts":1789353279950,"field":"severity","old":"medium","new":"none"},{"seq":180218,"id":"CVE-2026-78838","ts":1789350265241,"field":"cvss","old":null,"new":"6.5"},{"seq":180217,"id":"CVE-2026-78838","ts":1789350265241,"field":"severity","old":"none","new":"medium"},{"seq":179011,"id":"CVE-2026-78838","ts":1789348256904,"field":"cvss","old":"6.5","new":null},{"seq":179010,"id":"CVE-2026-78838","ts":1789348256904,"field":"severity","old":"medium","new":"none"},{"seq":177804,"id":"CVE-2026-78838","ts":1789346355758,"field":"cvss","old":null,"new":"6.5"},{"seq":177803,"id":"CVE-2026-78838","ts":1789346355758,"field":"severity","old":"none","new":"medium"},{"seq":176597,"id":"CVE-2026-78838","ts":1789343156660,"field":"cvss","old":"6.5","new":null},{"seq":176596,"id":"CVE-2026-78838","ts":1789343156660,"field":"severity","old":"medium","new":"none"},{"seq":174714,"id":"CVE-2026-78838","ts":1789334852916,"field":"cvss","old":null,"new":"6.5"},{"seq":174713,"id":"CVE-2026-78838","ts":1789334852916,"field":"severity","old":"none","new":"medium"},{"seq":173509,"id":"CVE-2026-78838","ts":1789333641118,"field":"cvss","old":"6.5","new":null},{"seq":173508,"id":"CVE-2026-78838","ts":1789333641118,"field":"severity","old":"medium","new":"none"},{"seq":172323,"id":"CVE-2026-78838","ts":1789331080384,"field":"cvss","old":null,"new":"6.5"},{"seq":172322,"id":"CVE-2026-78838","ts":1789331080384,"field":"severity","old":"none","new":"medium"},{"seq":171137,"id":"CVE-2026-78838","ts":1789328750679,"field":"cvss","old":"6.5","new":null},{"seq":171136,"id":"CVE-2026-78838","ts":1789328750679,"field":"severity","old":"medium","new":"none"},{"seq":169932,"id":"CVE-2026-78838","ts":1789327144380,"field":"cvss","old":null,"new":"6.5"},{"seq":169931,"id":"CVE-2026-78838","ts":1789327144380,"field":"severity","old":"none","new":"medium"}]}