PT-2025-41229 · Unknown · Jhumanj Opnform

Balejin · Published 2025-10-08 · Updated 2025-10-08 · CVE-2025-11436

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JhumanJ OpnForm versions up to 1.9.3

Description A flaw exists in JhumanJ OpnForm up to version 1.9.3 related to an unrestricted upload issue stemming from manipulation of an unknown functionality within the /answer file. This manipulation allows for remote exploitation. The exploit is publicly available.

Recommendations Implement patch 95c3e23856465d202e6aec10bdb6ee0688b5305a to correct this issue.

Exploit

Fix

Unrestricted File Upload

Improper Access Control

Weakness Enumeration

CWE-434

CWE-284

Related Identifiers

CVE-2025-11436

Affected Products

Jhumanj Opnform

References · 11

• 🔥 https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.dm5ttliupfqn · Exploit
• https://github.com/JhumanJ/OpnForm/pull/900/commits/95c3e23856465d202e6aec10bdb6ee0688b5305a · Patch
• https://osv.dev/vulnerability/CVE-2025-11436 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11436 · Security Note
• https://vuldb.com/?ctiid.327373 · Note
• https://twitter.com/VulmonFeeds/status/1975870064172700094 · Twitter Post
• https://t.me/CVEtracker/34415 · Telegram Post
• https://twitter.com/CVEnew/status/1975809101868192066 · Twitter Post
• https://vuldb.com/?id.327373 · Note
• https://vuldb.com/?submit.666877 · Note
• https://t.me/cveNotify/137768 · Telegram Post