CVE-2026-78837

CVE-2026-78837 is an unauthenticated SQL injection flaw (CWE-89) in the ap_form_{id} parameter of AppNitro MachForm, a commercial self-hosted PHP form builder, with version 30 ('v30') named in the advisory. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates a remote, unauthenticated attacker with no user interaction can trigger it by submitting a crafted SQL statement through that parameter. Successful exploitation yields unauthorized reads of sensitive database contents — potentially including form submission data held in MachForm's tables — with no integrity or availability impact. Any organization running an internet-reachable MachForm instance is potentially exposed, as are the individuals whose information is stored in its form databases. No public proof-of-concept or in-the-wild exploitation is currently known; the flaw is not in CISA KEV, and EPSS assigns it a 0.2% probability of exploitation within 30 days (11th percentile).

What to do: Check your installed MachForm version and, if running v30, update as soon as AppNitro publishes a fix, since the flaw needs no authentication and exposes confidential data stored in the product's database. Until patched, mitigate with WAF rules or input filtering on the affected parameter, restrict public reachability of MachForm endpoints, and review web and database logs for anomalous SQL touching ap_form_* tables. No exploitation has been reported, so there is no evidence of active compromise, but prioritize any internet-exposed deployment.