# CVE-2026-78837: AppNitro MachForm SQL injection in ap_form parameter

Source: https://junglewise.ai/threats/cve-2026-78837-appnitro-machform-sql-injection-in-ap-form-parameter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-78837 · Severity: high · CVSS 7.5 · Published 2026-09-08

AppNitro MachForm is a form-building platform used to create and manage online forms. A SQL injection vulnerability in form handling allows unauthenticated attackers to inject malicious SQL code, potentially exposing sensitive database information stored in form submissions and customer data.

Technologies: [AppNitro MachForm](https://junglewise.ai/threats/technologies/machform). Vendors: [AppNitro](https://junglewise.ai/threats/vendors/appnitro).

## Quick answers

**Is CVE-2026-78837 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78837 being exploited in the wild.

**How severe is CVE-2026-78837?** High severity, with a CVSS score of 7.5, published 8 September 2026.

**Which products and versions are affected?** AppNitro MachForm v30.

**Is there a fix for CVE-2026-78837?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-78837 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-78837?** Check whether you run AppNitro MachForm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a SQL injection flaw in the ap_form_{id} parameter and filter[filters][0][field] parameter processed by grid_datasource.php. An unauthenticated attacker can craft malicious SQL statements to enumerate database schema and extract sensitive data. The attack requires network access to the vulnerable endpoint but no authentication or user interaction. An attacker can enumerate valid column names in database tables and extract sensitive information including form submissions and customer data. Patches for MachForm v30 should be applied immediately.

## Affected products

- AppNitro MachForm v30

## Timeline

- 2026-09-08: disclosed

## References

- [https://github.com/nabeelmkhan/CVE-2026-78837](https://github.com/nabeelmkhan/CVE-2026-78837)
- [https://packetstormsecurity.com/](https://packetstormsecurity.com/)

## Related threats

- [AppNitro MachForm reflected XSS in grid_datasource.php](https://junglewise.ai/threats/cve-2026-78838-appnitro-machform-reflected-xss-in-grid-datasource-php)
- [AppNitro MachForm arbitrary file upload leading to code execution](https://junglewise.ai/threats/cve-2026-78839-appnitro-machform-arbitrary-file-upload-leading-to-code-execution)