A flaw has been found in JhumanJ OpnForm up to 1.9.3. This affects an unknown part of the file /api/open/forms/ of the component Form Editor. This manipulation causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. This issue is currently under review for additional handling. As of right now the vendor has stated that the feature is disabled until the user has configured their own domain which will mitigate this attack vector.
References
| Link | Resource |
|---|---|
| https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.nowv0hlgdq8 | Exploit Third Party Advisory |
| https://vuldb.com/?ctiid.327374 | Permissions Required VDB Entry |
| https://vuldb.com/?id.327374 | Third Party Advisory VDB Entry |
| https://vuldb.com/?submit.666878 | Third Party Advisory VDB Entry |
Configurations
History
09 Oct 2025, 16:18
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:jhumanj:opnform:*:*:*:*:*:*:*:* | |
| References | () https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.nowv0hlgdq8 - Exploit, Third Party Advisory | |
| References | () https://vuldb.com/?ctiid.327374 - Permissions Required, VDB Entry | |
| References | () https://vuldb.com/?id.327374 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/?submit.666878 - Third Party Advisory, VDB Entry | |
| First Time |
Jhumanj
Jhumanj opnform |
08 Oct 2025, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-08 06:15
Updated : 2025-10-09 16:18
NVD link : CVE-2025-11437
Mitre link : CVE-2025-11437
CVE.ORG link : CVE-2025-11437
JSON object : View
Products Affected
jhumanj
- opnform