PT-2025-41236 · Jhumanj · Jhumanj Opnform

Balejin · Published 2025-10-08 · Updated 2025-10-08 · CVE-2025-11441

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions JhumanJ OpnForm versions up to 1.9.3

Description A security issue exists in JhumanJ OpnForm related to improper restriction of excessive authentication attempts. The issue is located within the HTTP Header Handler component and involves manipulation of the X-Forwarded-For argument. The attack can be carried out remotely and requires a high degree of complexity, though exploitability is described as difficult. The exploit is publicly available.

Recommendations Install patch 11e99960e14ca986b1a001a56e7533223d2cfa5b to address this issue.

Exploit

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

CWE-799

Related Identifiers

CVE-2025-11441

Affected Products

Jhumanj Opnform

References · 11

• 🔥 https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.va2ituwwqcf3 · Exploit
• https://github.com/JhumanJ/OpnForm/pull/900/commits/11e99960e14ca986b1a001a56e7533223d2cfa5b · Patch
• https://osv.dev/vulnerability/CVE-2025-11441 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11441 · Security Note
• https://vuldb.com/?ctiid.327378 · Note
• https://vuldb.com/?id.327378 · Note
• https://twitter.com/CVEnew/status/1975826101273235569 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1975852146491814387 · Twitter Post
• https://t.me/CVEtracker/34420 · Telegram Post
• https://t.me/cveNotify/137773 · Telegram Post
• https://vuldb.com/?submit.666888 · Note