CVE-2025-11441

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-11441
A vulnerability was identified in JhumanJ OpnForm up to 1.9.3. The affected element is an unknown function of the component HTTP Header Handler. The manipulation of the argument X-Forwarded-For leads to improper restriction of excessive authentication attempts. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitability is described as difficult. The exploit is publicly available and might be used. The identifier of the patch is 11e99960e14ca986b1a001a56e7533223d2cfa5b. It is suggested to install a patch to address this issue.

3.7 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.6 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:N/AC:H/Au:N/C:P/I:N/A:N

Exploitability : 4.9 / Impact : 2.9

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.va2ituwwqcf3 Exploit Third Party Advisory
https://github.com/JhumanJ/OpnForm/pull/900/commits/11e99960e14ca986b1a001a56e7533223d2cfa5b Patch
https://vuldb.com/?ctiid.327378 Permissions Required VDB Entry
https://vuldb.com/?id.327378 Third Party Advisory VDB Entry
https://vuldb.com/?submit.666888 Third Party Advisory VDB Entry
https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.va2ituwwqcf3 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:jhumanj:opnform:*:*:*:*:*:*:*:*
History

09 Oct 2025, 16:16

Type Values Removed Values Added
First Time Jhumanj
Jhumanj opnform
CPE cpe:2.3:a:jhumanj:opnform:*:*:*:*:*:*:*:*
References () https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.va2ituwwqcf3 - () https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.va2ituwwqcf3 - Exploit, Third Party Advisory
References () https://github.com/JhumanJ/OpnForm/pull/900/commits/11e99960e14ca986b1a001a56e7533223d2cfa5b - () https://github.com/JhumanJ/OpnForm/pull/900/commits/11e99960e14ca986b1a001a56e7533223d2cfa5b - Patch
References () https://vuldb.com/?ctiid.327378 - () https://vuldb.com/?ctiid.327378 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.327378 - () https://vuldb.com/?id.327378 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.666888 - () https://vuldb.com/?submit.666888 - Third Party Advisory, VDB Entry

08 Oct 2025, 14:15

Type Values Removed Values Added
References () https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.va2ituwwqcf3 - () https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.va2ituwwqcf3 -

08 Oct 2025, 07:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-10-08 07:15

Updated : 2025-10-09 16:16

NVD link : CVE-2025-11441

Mitre link : CVE-2025-11441

CVE.ORG link : CVE-2025-11441

JSON object : View

Products Affected

jhumanj

  • opnform
CWE
CWE-307

Improper Restriction of Excessive Authentication Attempts

CWE-799

Improper Control of Interaction Frequency