Vulnerability · Published Oct 8, 2025 · Assigned by VulDB
CVE-2025-11443JhumanJ OpnForm Forgotten Password email information exposure
Low 3.7
In plain English
A low-severity information exposure in OpnForm from JhumanJ. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Official description
A weakness has been identified in JhumanJ OpnForm up to 1.9.3. This affects an unknown function of the file /api/password/email of the component Forgotten Password Handler. This manipulation causes information exposure through discrepancy. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. The exploit has been made available to the public and could be exploited. This issue is currently aligned with Laravel issue #46465, which is why no mitigation action was taken.
Affected products (as reported)
Weakness: CWE-203, CWE-200 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C
References
- VDB-327380 | JhumanJ OpnForm Forgotten Password email information exposure vdb-entry
- VDB-327380 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #666890 | GitHub OpnForm 1.9.3 Account Enumeration on Password Recovery third-party-advisory
- https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.my0ldciyllp exploit