CVE-2025-11441
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
A vulnerability in JhumanJ OpnForm up to 1.9.3 affects an unknown function of the HTTP Header Handler component. Manipulation of the X-Forwarded-For argument leads to improper restriction of excessive authentication attempts. The attack can be carried out remotely but requires high complexity and is difficult to exploit. The exploit is publicly available. A patch is identified as 11e99960e14ca986b1a001a56e7533223d2cfa5b.
Risk Assessment
An attacker may bypass login attempt limits, potentially enabling brute-force attacks on user accounts, but the high complexity reduces the risk.
Recommendation
Install the available patch (commit 11e99960e14ca986b1a001a56e7533223d2cfa5b) or upgrade OpnForm to a newer version.
Other vulnerabilities in OpnForm
See all- CVE-2026-75106Critical
OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for any submission. Attackers can read other respondents' full submission data through the submission-fetch endpoint or overwrite submissions by supplying predicted hashes to the answer endpoint.
- CVE-2025-11443Low
A weakness in JhumanJ OpnForm up to 1.9.3 affects an unknown function in /api/password/email of the Forgotten Password Handler component. This manipulation causes information exposure through discrepancy. The attack can be initiated remotely but has high complexity and is difficult to exploit. The exploit is public. This issue is aligned with Laravel issue #46465, so no mitigation was taken.
- CVE-2025-11437Low
A flaw in JhumanJ OpnForm up to 1.9.3 affects an unknown part of /api/open/forms/ of the Form Editor component. This manipulation causes cross site scripting. The attack may be initiated remotely. The exploit has been published. The vendor has stated that the feature is disabled until the user configures their own domain, which mitigates the attack vector.
- CVE-2025-11436Medium
A vulnerability was detected in OpnForm up to 1.9.3 allowing unrestricted file upload in /answer. The attack can be launched remotely. The exploit is public and a patch is available.
- CVE-2025-11435Medium
A cross-site scripting (XSS) vulnerability was found in JhumanJ OpnForm up to 1.9.3 in the file /show/submissions. The attack can be initiated remotely. The exploit has been publicly disclosed and may be used. The patch identifier is a2af1184e53953afa8cb052f4055f288adcaa608.
Original NVD description (English source)
A vulnerability was identified in JhumanJ OpnForm up to 1.9.3. The affected element is an unknown function of the component HTTP Header Handler. The manipulation of the argument X-Forwarded-For leads to improper restriction of excessive authentication attempts. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitability is described as difficult. The exploit is publicly available and might be used. The identifier of the patch is 11e99960e14ca986b1a001a56e7533223d2cfa5b. It is suggested to install a patch to address this issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS