Low severity · published Oct 8, 2025
CVE-2025-11441
JhumanJ OpnForm HTTP Header excessive authentication
3.7
CVSS
0.6%
EPSS
No
On KEV
Description
A vulnerability was identified in JhumanJ OpnForm up to 1.9.3. The affected element is an unknown function of the component HTTP Header Handler. The manipulation of the argument X-Forwarded-For leads to improper restriction of excessive authentication attempts. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitability is described as difficult. The exploit is publicly available and might be used. The identifier of the patch is 11e99960e14ca986b1a001a56e7533223d2cfa5b. It is suggested to install a patch to address this issue.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
OpnForm · JhumanJ
1.9.0; 1.9.1; 1.9.2; 1.9.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-11441
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-11441
Exploit
https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.va2ituwwqcf3
Patch
https://github.com/JhumanJ/OpnForm/pull/900/commits/11e99960e14ca986b1a001a56e7533223d2cfa5b
Permissions Required
https://vuldb.com/?ctiid.327378
Third Party Advisory
https://vuldb.com/?id.327378
Third Party Advisory
https://vuldb.com/?submit.666888
More from OpnForm
8.8
CVE-2025-11436
JhumanJ OpnForm answer unrestricted upload
6.3
CVE-2025-11438
JhumanJ OpnForm API Endpoint custom-domains authorization
6.1
CVE-2025-11435
JhumanJ OpnForm submissions cross site scripting
5.9
CVE-2025-11443
JhumanJ OpnForm Forgotten Password email information exposure
4.8
CVE-2025-11437
JhumanJ OpnForm Form Editor forms cross site scripting
