Medium severity · published Oct 8, 2025
CVE-2025-11439
JhumanJ OpnForm integrations authorization
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability was found in JhumanJ OpnForm up to 1.9.3. This issue affects some unknown processing of the file /show/integrations. Performing manipulation results in missing authorization. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The patch is named 11d97d78f2de2cb49f79baed6bde8b611ec1f384. It is recommended to apply a patch to fix this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
OpnForm · JhumanJ
1.9.0; 1.9.1; 1.9.2; 1.9.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-11439
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-11439
Exploit
https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.reuyi9lwvpj
Patch
https://github.com/JhumanJ/OpnForm/pull/900/commits/11d97d78f2de2cb49f79baed6bde8b611ec1f384
Permissions Required
https://vuldb.com/?ctiid.327376
Third Party Advisory
https://vuldb.com/?id.327376
Third Party Advisory
https://vuldb.com/?submit.666880
More from OpnForm
8.8
CVE-2025-11436
JhumanJ OpnForm answer unrestricted upload
6.3
CVE-2025-11438
JhumanJ OpnForm API Endpoint custom-domains authorization
6.1
CVE-2025-11435
JhumanJ OpnForm submissions cross site scripting
5.9
CVE-2025-11443
JhumanJ OpnForm Forgotten Password email information exposure
4.8
CVE-2025-11437
JhumanJ OpnForm Form Editor forms cross site scripting