Medium severity · published Oct 8, 2025
CVE-2025-11440
JhumanJ OpnForm edit access control
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability was determined in JhumanJ OpnForm up to 1.9.3. Impacted is an unknown function of the file /edit. Executing manipulation can lead to improper access controls. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This patch is called b15e29021d326be127193a5dbbd528c4e37e6324. Applying a patch is advised to resolve this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
OpnForm · JhumanJ
1.9.0; 1.9.1; 1.9.2; 1.9.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-11440
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-11440
Exploit
https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.t78mmp24qqk5
Patch
https://github.com/JhumanJ/OpnForm/pull/900/commits/b15e29021d326be127193a5dbbd528c4e37e6324
Permissions Required
https://vuldb.com/?ctiid.327377
Third Party Advisory
https://vuldb.com/?id.327377
Third Party Advisory
https://vuldb.com/?submit.666881
More from OpnForm
8.8
CVE-2025-11436
JhumanJ OpnForm answer unrestricted upload
6.3
CVE-2025-11438
JhumanJ OpnForm API Endpoint custom-domains authorization
6.1
CVE-2025-11435
JhumanJ OpnForm submissions cross site scripting
5.9
CVE-2025-11443
JhumanJ OpnForm Forgotten Password email information exposure
4.8
CVE-2025-11437
JhumanJ OpnForm Form Editor forms cross site scripting