CVE-2025-11443
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
A weakness in JhumanJ OpnForm up to 1.9.3 affects an unknown function in /api/password/email of the Forgotten Password Handler component. This manipulation causes information exposure through discrepancy. The attack can be initiated remotely but has high complexity and is difficult to exploit. The exploit is public. This issue is aligned with Laravel issue #46465, so no mitigation was taken.
Risk Assessment
An attacker may exploit response discrepancies to enumerate user accounts, potentially leading to information disclosure, but high complexity limits the risk.
Recommendation
Monitor vendor updates and consider additional protections such as restricting access to the endpoint.
Other vulnerabilities in OpnForm
See all- CVE-2026-75106Critical
OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for any submission. Attackers can read other respondents' full submission data through the submission-fetch endpoint or overwrite submissions by supplying predicted hashes to the answer endpoint.
- CVE-2025-11441Low
A vulnerability in JhumanJ OpnForm up to 1.9.3 affects an unknown function of the HTTP Header Handler component. Manipulation of the X-Forwarded-For argument leads to improper restriction of excessive authentication attempts. The attack can be carried out remotely but requires high complexity and is difficult to exploit. The exploit is publicly available. A patch is identified as 11e99960e14ca986b1a001a56e7533223d2cfa5b.
- CVE-2025-11437Low
A flaw in JhumanJ OpnForm up to 1.9.3 affects an unknown part of /api/open/forms/ of the Form Editor component. This manipulation causes cross site scripting. The attack may be initiated remotely. The exploit has been published. The vendor has stated that the feature is disabled until the user configures their own domain, which mitigates the attack vector.
- CVE-2025-11436Medium
A vulnerability was detected in OpnForm up to 1.9.3 allowing unrestricted file upload in /answer. The attack can be launched remotely. The exploit is public and a patch is available.
- CVE-2025-11435Medium
A cross-site scripting (XSS) vulnerability was found in JhumanJ OpnForm up to 1.9.3 in the file /show/submissions. The attack can be initiated remotely. The exploit has been publicly disclosed and may be used. The patch identifier is a2af1184e53953afa8cb052f4055f288adcaa608.
Original NVD description (English source)
A weakness has been identified in JhumanJ OpnForm up to 1.9.3. This affects an unknown function of the file /api/password/email of the component Forgotten Password Handler. This manipulation causes information exposure through discrepancy. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. The exploit has been made available to the public and could be exploited. This issue is currently aligned with Laravel issue #46465, which is why no mitigation action was taken.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS