CVE-2025-11436

OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for any submission. Attackers can read other respondents' full submission data through the submission-fetch endpoint or overwrite submissions by supplying predicted hashes to the answer endpoint.

A weakness in JhumanJ OpnForm up to 1.9.3 affects an unknown function in /api/password/email of the Forgotten Password Handler component. This manipulation causes information exposure through discrepancy. The attack can be initiated remotely but has high complexity and is difficult to exploit. The exploit is public. This issue is aligned with Laravel issue #46465, so no mitigation was taken.

A vulnerability in JhumanJ OpnForm up to 1.9.3 affects an unknown function of the HTTP Header Handler component. Manipulation of the X-Forwarded-For argument leads to improper restriction of excessive authentication attempts. The attack can be carried out remotely but requires high complexity and is difficult to exploit. The exploit is publicly available. A patch is identified as 11e99960e14ca986b1a001a56e7533223d2cfa5b.

A flaw in JhumanJ OpnForm up to 1.9.3 affects an unknown part of /api/open/forms/ of the Form Editor component. This manipulation causes cross site scripting. The attack may be initiated remotely. The exploit has been published. The vendor has stated that the feature is disabled until the user configures their own domain, which mitigates the attack vector.

A cross-site scripting (XSS) vulnerability was found in JhumanJ OpnForm up to 1.9.3 in the file /show/submissions. The attack can be initiated remotely. The exploit has been publicly disclosed and may be used. The patch identifier is a2af1184e53953afa8cb052f4055f288adcaa608.