PT-2025-41238 · Unknown · Jhumanj Opnform

Balejin · Published 2025-10-08 · Updated 2025-10-08 · CVE-2025-11442

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions JhumanJ OpnForm versions up to 1.9.3

Description A security flaw exists in JhumanJ OpnForm. The issue involves an unknown function within the component’s API Endpoint and can lead to cross-site request forgery. The attack can be initiated remotely. While the vendor indicates API calls require authentication via Authorization Bearer Tokens, mitigating classic CSRF attacks, an attacker could exploit the flaw if they obtain the JWT through other means, such as cross-site scripting (XSS). The exploit has been publicly released.

Recommendations Versions prior to 1.9.3 should be used.

Exploit

Fix

Missing Authorization

CSRF

Weakness Enumeration

CWE-862

CWE-352

Related Identifiers

CVE-2025-11442

Affected Products

Jhumanj Opnform

References · 9

• 🔥 https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.w5b1nllxwvdq · Exploit
• https://osv.dev/vulnerability/CVE-2025-11442 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11442 · Security Note
• https://vuldb.com/?ctiid.327379 · Note
• https://vuldb.com/?id.327379 · Note
• https://vuldb.com/?submit.666889 · Note
• https://twitter.com/CVEnew/status/1975831140251672937 · Twitter Post
• https://t.me/cveNotify/137775 · Telegram Post
• https://t.me/CVEtracker/34422 · Telegram Post