← Vulnerability feed

Vulnerability record · CVE-2024-37763 · published 1 July 2024

CVE-2024-37763: Machform cross-site scripting vulnerability

Machform · Machform

MachForm up to version 19 is affected by an unauthenticated stored cross-site scripting which affects users with valid sessions whom can view compiled forms results.

5.4 CVSS 3.1 Medium EPSS 0.67% · top 49.6% CWE-79 · Cross-site scripting
5.4CVSS 3.1 base score
0.67%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

MachForm up to version 19 is affected by an unauthenticated stored cross-site scripting which affects users with valid sessions whom can view compiled forms results.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/Atreb92/cve-2024-37763 ExploitThird Party Advisory
https://github.com/Atreb92/cve-2024-37763 ExploitThird Party Advisory

Track CVE-2024-37763 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.9CVE-2024-37762Machform unrestricted file upload vulnerabilityMachForm up to version 21 is affected by an authenticated unrestricted file upload which leads to a remote code execution.EPSS 1.5%9.8CVE-2018-6410Machform sql injection vulnerabilityAn issue was discovered in Appnitro MachForm before 4.2.3. There is a download.php SQL injection via the q parameter.EPSS 4.7%9.8CVE-2018-6411Machform unrestricted file upload vulnerabilityAn issue was discovered in Appnitro MachForm before 4.2.3. When the form is set to filter a blacklist, it automatically adds dangerous extensions to …EPSS 5.6%8.8CVE-2024-37765Machform sql injection vulnerabilityMachform up to version 19 is affected by an authenticated Blind SQL injection in the user account settings page.EPSS 0.83%8.8CVE-2021-20102Machform cross-site request forgery vulnerabilityMachform prior to version 16 is vulnerable to cross-site request forgery due to a lack of CSRF tokens in place.EPSS 0.51%8.1CVE-2021-20104Machform unrestricted file upload vulnerabilityMachform prior to version 16 is vulnerable to unauthenticated remote code execution due to insufficient sanitization of file attachments uploaded wit…EPSS 2.2%7.5CVE-2013-4948Machform sql injection vulnerabilitySQL injection vulnerability in view.php in Machform 2 allows remote attackers to execute arbitrary SQL commands via the element_2 parameter.EPSS 3.5%6.8CVE-2013-4949Machform vulnerabilityUnrestricted file upload vulnerability in view.php in Machform 2 allows remote attackers to execute arbitrary PHP code by uploading a PHP file, then …EPSS 5.5%

Source: NIST National Vulnerability Database (record CVE-2024-37763), CISA KEV, FIRST EPSS (scores of 2026-10-05). This page is refreshed as NVD updates the record.