← Vulnerability feed

Vulnerability record · CVE-2024-37764 · published 1 July 2024

CVE-2024-37764: Machform cross-site scripting vulnerability

Machform · Machform

MachForm up to version 19 is affected by an authenticated stored cross-site scripting.

5.4 CVSS 3.1 Medium EPSS 0.59% · top 53.8% CWE-79 · Cross-site scripting
5.4CVSS 3.1 base score
0.59%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

MachForm up to version 19 is affected by an authenticated stored cross-site scripting.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/Atreb92/cve-2024-37764 ExploitThird Party Advisory
https://github.com/Atreb92/cve-2024-37764 ExploitThird Party Advisory

Track CVE-2024-37764 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.9CVE-2024-37762Machform unrestricted file upload vulnerabilityMachForm up to version 21 is affected by an authenticated unrestricted file upload which leads to a remote code execution.EPSS 1.5%9.8CVE-2018-6410Machform sql injection vulnerabilityAn issue was discovered in Appnitro MachForm before 4.2.3. There is a download.php SQL injection via the q parameter.EPSS 4.7%9.8CVE-2018-6411Machform unrestricted file upload vulnerabilityAn issue was discovered in Appnitro MachForm before 4.2.3. When the form is set to filter a blacklist, it automatically adds dangerous extensions to …EPSS 5.6%8.8CVE-2024-37765Machform sql injection vulnerabilityMachform up to version 19 is affected by an authenticated Blind SQL injection in the user account settings page.EPSS 0.83%8.8CVE-2021-20102Machform cross-site request forgery vulnerabilityMachform prior to version 16 is vulnerable to cross-site request forgery due to a lack of CSRF tokens in place.EPSS 0.51%8.1CVE-2021-20104Machform unrestricted file upload vulnerabilityMachform prior to version 16 is vulnerable to unauthenticated remote code execution due to insufficient sanitization of file attachments uploaded wit…EPSS 2.2%7.5CVE-2013-4948Machform sql injection vulnerabilitySQL injection vulnerability in view.php in Machform 2 allows remote attackers to execute arbitrary SQL commands via the element_2 parameter.EPSS 3.5%6.8CVE-2013-4949Machform vulnerabilityUnrestricted file upload vulnerability in view.php in Machform 2 allows remote attackers to execute arbitrary PHP code by uploading a PHP file, then …EPSS 5.5%

Source: NIST National Vulnerability Database (record CVE-2024-37764), CISA KEV, FIRST EPSS (scores of 2026-10-04). This page is refreshed as NVD updates the record.