{"id":"CVE-2025-11440","state":"PUBLISHED","title":"JhumanJ OpnForm edit access control","description":"A vulnerability was determined in JhumanJ OpnForm up to 1.9.3. Impacted is an unknown function of the file /edit. Executing manipulation can lead to improper access controls. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This patch is called b15e29021d326be127193a5dbbd528c4e37e6324. Applying a patch is advised to resolve this issue.","publishedAt":"2025-10-08T07:02:07.818Z","updatedAt":"2025-10-08T13:48:06.257Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["JhumanJ OpnForm"],"affected":[{"vendor":"JhumanJ","product":"OpnForm","versions":[{"version":"1.9.0","status":"affected"},{"version":"1.9.1","status":"affected"},{"version":"1.9.2","status":"affected"},{"version":"1.9.3","status":"affected"}]}],"references":["https://vuldb.com/?id.327377","https://vuldb.com/?ctiid.327377","https://vuldb.com/?submit.666881","https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.t78mmp24qqk5","https://github.com/JhumanJ/OpnForm/pull/900/commits/b15e29021d326be127193a5dbbd528c4e37e6324"],"weaknesses":["CWE-284","CWE-266"],"ingestedAt":"2026-10-29T20:08:31.050Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/11xxx/CVE-2025-11440.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-11440","state":"PUBLISHED","datePublished":"2025-10-08T07:02:07.818Z","dateUpdated":"2025-10-08T13:48:06.257Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2025-10-07T13:17:24.556Z"},"containers":{"cna":{"title":"JhumanJ OpnForm edit access control","descriptions":[{"lang":"en","value":"A vulnerability was determined in JhumanJ OpnForm up to 1.9.3. Impacted is an unknown function of the file /edit. Executing manipulation can lead to improper access controls. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This patch is called b15e29021d326be127193a5dbbd528c4e37e6324. Applying a patch is advised to resolve this issue."},{"lang":"de","value":"Es wurde eine Schwachstelle in JhumanJ OpnForm up to 1.9.3 entdeckt. Es geht hierbei um eine nicht näher spezifizierte Funktion der Datei /edit. Dank Manipulation mit unbekannten Daten kann eine improper access controls-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk erfolgen. Die Schwachstelle wurde öffentlich offengelegt und könnte ausgenutzt werden. Der Patch trägt den Namen b15e29021d326be127193a5dbbd528c4e37e6324. Es wird geraten, einen Patch zu installieren, um dieses Problem zu lösen."}],"affected":[{"vendor":"JhumanJ","product":"OpnForm","versions":[{"version":"1.9.0","status":"affected"},{"version":"1.9.1","status":"affected"},{"version":"1.9.2","status":"affected"},{"version":"1.9.3","status":"affected"}]}],"references":[{"url":"https://vuldb.com/?id.327377","name":"VDB-327377 | JhumanJ OpnForm edit access control","tags":["vdb-entry"]},{"url":"https://vuldb.com/?ctiid.327377","name":"VDB-327377 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.666881","name":"Submit #666881 | GitHub OpnForm 1.9.3 Improper Access Controls","tags":["third-party-advisory"]},{"url":"https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.t78mmp24qqk5","tags":["exploit"]},{"url":"https://github.com/JhumanJ/OpnForm/pull/900/commits/b15e29021d326be127193a5dbbd528c4e37e6324","tags":["issue-tracking","patch"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":4.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":4.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-284","type":"CWE","lang":"en","description":"Improper Access Controls"}]},{"descriptions":[{"cweId":"CWE-266","type":"CWE","lang":"en","description":"Incorrect Privilege Assignment"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2025-10-08T07:02:07.818Z"},"timeline":[{"time":"2025-10-07T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-10-07T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-10-07T15:22:49.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"balejin (VulDB User)","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.t78mmp24qqk5","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-10-08T13:48:03.045413Z","id":"CVE-2025-11440","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-08T13:48:06.257Z"}}]}}}