CVE-2025-11440CWE-266CWE-284broken-access-control

CVE-2025-11440

Medium · published October 8, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
27.7
In the wild
Unconfirmed
What it is

A vulnerability was determined in JhumanJ OpnForm up to 1.9.3. Impacted is an unknown function of the file /edit. Executing manipulation can lead to improper access controls. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This patch is called b15e29021d326be127193a5dbbd528c4e37e6324. Applying a patch is advised to resolve this issue.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00352 · 27.7th percentile
Weaknesses
CWE-266 · Incorrect Privilege Assignment; CWE-284 · Improper Access Control
Published
2025-10-08T11:15Z
Affected products (1)
ProductVersionsFixed in
jhumanj/opnform≤ 1.9.3—
References (6)
https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.t78mmp24qqk5 · [email protected]https://github.com/JhumanJ/OpnForm/pull/900/commits/b15e29021d326be127193a5dbbd528c4e37e6324 · [email protected]https://vuldb.com/?ctiid.327377 · [email protected]https://vuldb.com/?id.327377 · [email protected]https://vuldb.com/?submit.666881 · [email protected]https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.t78mmp24qqk5 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 08 OCT 07:02Z
    JhumanJ OpnForm edit access control
    cvelistv5