PT-2025-41229 · Unknown · Jhumanj Opnform

Balejin · CVE-2025-11436 · Published 2025-10-08 · Updated 2025-10-08

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JhumanJ OpnForm versions up to 1.9.3

Description A flaw exists in JhumanJ OpnForm up to version 1.9.3 related to an unrestricted upload issue stemming from manipulation of an unknown functionality within the /answer file. This manipulation allows for remote exploitation. The exploit is publicly available.

Recommendations Implement patch 95c3e23856465d202e6aec10bdb6ee0688b5305a to correct this issue.

Exploit

Fix

Improper Access Control

Unrestricted File Upload

Weakness Enumeration

CWE-284

CWE-434

Related Identifiers

CVE-2025-11436

Affected Products

Jhumanj Opnform

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11436.json · Exploit
• 🔥 https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.dm5ttliupfqn · Exploit
• https://github.com/JhumanJ/OpnForm/pull/900/commits/95c3e23856465d202e6aec10bdb6ee0688b5305a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-11436 · Security Note
• https://osv.dev/vulnerability/CVE-2025-11436 · Vendor Advisory
• https://vuldb.com/?id.327373 · Note
• https://vuldb.com/?submit.666877 · Note
• https://vuldb.com/?ctiid.327373 · Note
• https://twitter.com/VulmonFeeds/status/1975870064172700094 · Twitter Post
• https://twitter.com/CVEnew/status/1975809101868192066 · Twitter Post
• https://t.me/cveNotify/137768 · Telegram Post
• https://t.me/CVEtracker/34415 · Telegram Post