PT-2025-41233 · Opnform · Opnform

Balejin · Published 2025-10-08 · Updated 2025-10-08 · CVE-2025-11438

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions JhumanJ OpnForm versions up to 1.9.3

Description A missing authorization check exists in the API endpoint responsible for managing custom domains, located at /custom-domains. This allows for unauthorized manipulation of custom domain settings. The vulnerability affects unknown code within the /custom-domains file of the API Endpoint component. The exploit has been publicly disclosed.

Recommendations Apply the patch beb153ce52dceb971c1518f98333328c95f1ba20.

Exploit

Fix

Incorrect Authorization

Missing Authorization

Weakness Enumeration

CWE-863

CWE-862

Related Identifiers

CVE-2025-11438

Affected Products

Opnform

References · 12

• 🔥 https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.gm61tyll8uys · Exploit
• https://github.com/JhumanJ/OpnForm/pull/900/commits/beb153ce52dceb971c1518f98333328c95f1ba20 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-11438 · Security Note
• https://osv.dev/vulnerability/CVE-2025-11438 · Vendor Advisory
• https://twitter.com/transilienceai/status/1975865730097619415 · Twitter Post
• https://twitter.com/transilienceai/status/1975865739287404740 · Twitter Post
• https://vuldb.com/?id.327375 · Note
• https://vuldb.com/?submit.666879 · Note
• https://t.me/CVEtracker/34417 · Telegram Post
• https://t.me/cveNotify/137770 · Telegram Post
• https://twitter.com/CVEnew/status/1975831142264938576 · Twitter Post
• https://vuldb.com/?ctiid.327375 · Note