CVE-2025-11435

OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for any submission. Attackers can read other respondents' full submission data through the submission-fetch endpoint or overwrite submissions by supplying predicted hashes to the answer endpoint.

A weakness in JhumanJ OpnForm up to 1.9.3 affects an unknown function in /api/password/email of the Forgotten Password Handler component. This manipulation causes information exposure through discrepancy. The attack can be initiated remotely but has high complexity and is difficult to exploit. The exploit is public. This issue is aligned with Laravel issue #46465, so no mitigation was taken.

A vulnerability in JhumanJ OpnForm up to 1.9.3 affects an unknown function of the HTTP Header Handler component. Manipulation of the X-Forwarded-For argument leads to improper restriction of excessive authentication attempts. The attack can be carried out remotely but requires high complexity and is difficult to exploit. The exploit is publicly available. A patch is identified as 11e99960e14ca986b1a001a56e7533223d2cfa5b.

A flaw in JhumanJ OpnForm up to 1.9.3 affects an unknown part of /api/open/forms/ of the Form Editor component. This manipulation causes cross site scripting. The attack may be initiated remotely. The exploit has been published. The vendor has stated that the feature is disabled until the user configures their own domain, which mitigates the attack vector.

A vulnerability was detected in OpnForm up to 1.9.3 allowing unrestricted file upload in /answer. The attack can be launched remotely. The exploit is public and a patch is available.