Medium severity · published Oct 8, 2025
CVE-2025-11435
JhumanJ OpnForm submissions cross site scripting
6.1
CVSS
0.4%
EPSS
No
On KEV
Description
A security vulnerability has been detected in JhumanJ OpnForm up to 1.9.3. Affected by this vulnerability is an unknown functionality of the file /show/submissions. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is a2af1184e53953afa8cb052f4055f288adcaa608. To fix this issue, it is recommended to deploy a patch.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
OpnForm · JhumanJ
1.9.0; 1.9.1; 1.9.2; 1.9.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-11435
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-11435
Exploit
https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?usp=sharing
Patch
https://github.com/JhumanJ/OpnForm/pull/900/commits/a2af1184e53953afa8cb052f4055f288adcaa608
Permissions Required
https://vuldb.com/?ctiid.327372
Third Party Advisory
https://vuldb.com/?id.327372
Third Party Advisory
https://vuldb.com/?submit.666876
More from OpnForm
8.8
CVE-2025-11436
JhumanJ OpnForm answer unrestricted upload
6.3
CVE-2025-11438
JhumanJ OpnForm API Endpoint custom-domains authorization
5.9
CVE-2025-11443
JhumanJ OpnForm Forgotten Password email information exposure
4.8
CVE-2025-11437
JhumanJ OpnForm Form Editor forms cross site scripting
4.3
CVE-2025-11442
JhumanJ OpnForm API Endpoint cross-site request forgery