CVE-2025-11437
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
A flaw in JhumanJ OpnForm up to 1.9.3 affects an unknown part of /api/open/forms/ of the Form Editor component. This manipulation causes cross site scripting. The attack may be initiated remotely. The exploit has been published. The vendor has stated that the feature is disabled until the user configures their own domain, which mitigates the attack vector.
Risk Assessment
An attacker can inject malicious scripts that execute in the user's browser, potentially leading to data or session theft, but the feature restriction reduces the risk.
Recommendation
Configure your own domain to disable the vulnerable feature, and monitor vendor updates.
Other vulnerabilities in OpnForm
See all- CVE-2026-75106Critical
OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for any submission. Attackers can read other respondents' full submission data through the submission-fetch endpoint or overwrite submissions by supplying predicted hashes to the answer endpoint.
- CVE-2025-11443Low
A weakness in JhumanJ OpnForm up to 1.9.3 affects an unknown function in /api/password/email of the Forgotten Password Handler component. This manipulation causes information exposure through discrepancy. The attack can be initiated remotely but has high complexity and is difficult to exploit. The exploit is public. This issue is aligned with Laravel issue #46465, so no mitigation was taken.
- CVE-2025-11441Low
A vulnerability in JhumanJ OpnForm up to 1.9.3 affects an unknown function of the HTTP Header Handler component. Manipulation of the X-Forwarded-For argument leads to improper restriction of excessive authentication attempts. The attack can be carried out remotely but requires high complexity and is difficult to exploit. The exploit is publicly available. A patch is identified as 11e99960e14ca986b1a001a56e7533223d2cfa5b.
- CVE-2025-11436Medium
A vulnerability was detected in OpnForm up to 1.9.3 allowing unrestricted file upload in /answer. The attack can be launched remotely. The exploit is public and a patch is available.
- CVE-2025-11435Medium
A cross-site scripting (XSS) vulnerability was found in JhumanJ OpnForm up to 1.9.3 in the file /show/submissions. The attack can be initiated remotely. The exploit has been publicly disclosed and may be used. The patch identifier is a2af1184e53953afa8cb052f4055f288adcaa608.
Original NVD description (English source)
A flaw has been found in JhumanJ OpnForm up to 1.9.3. This affects an unknown part of the file /api/open/forms/ of the component Form Editor. This manipulation causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. This issue is currently under review for additional handling. As of right now the vendor has stated that the feature is disabled until the user has configured their own domain which will mitigate this attack vector.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS