Vulnerability · Published Oct 8, 2025 · Assigned by VulDB

CVE-2025-11436JhumanJ OpnForm answer unrestricted upload

Medium 6.3

In plain English

A medium-severity unrestricted file upload in OpnForm from JhumanJ. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.4%top 67.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in JhumanJ OpnForm up to 1.9.3. Affected by this issue is some unknown functionality of the file /answer. The manipulation results in unrestricted upload. The attack can be launched remotely. The exploit is now public and may be used. The patch is identified as 95c3e23856465d202e6aec10bdb6ee0688b5305a. It is advisable to implement a patch to correct this issue.

Affected products (as reported)

Vendor	Product	Versions
JhumanJ	OpnForm	1.9.01.9.11.9.21.9.3

Weakness: CWE-434, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

References

VDB-327373 | JhumanJ OpnForm answer unrestricted upload vdb-entry
VDB-327373 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #666877 | GitHub OpnForm 1.9.3 Unrestricted Upload third-party-advisory
https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.dm5ttliupfqn exploit
https://github.com/JhumanJ/OpnForm/pull/900/commits/95c3e23856465d202e6aec10bdb6ee0688b5305a issue-tracking, patch