CVE-2025-11437

LOW

JhumanJ OpnForm < 1.9.3 - Cross-Site Scripting in Form Editor

Title source: llm
STIX 2.1

Description

A flaw has been found in JhumanJ OpnForm up to 1.9.3. This affects an unknown part of the file /api/open/forms/ of the component Form Editor. This manipulation causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. This issue is currently under review for additional handling. As of right now the vendor has stated that the feature is disabled until the user has configured their own domain which will mitigate this attack vector.

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry
https://vuldb.com/?id.327374
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.327374
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.666878

Scores

CVSS v3 2.4
EPSS 0.0027
EPSS Percentile 18.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79 CWE-94
Status published
Products (1)
jhumanj/opnform < 1.9.3
Published Oct 08, 2025
Tracked Since Feb 18, 2026