CVE-2025-11436

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-11436
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-11436.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-11436
Published
2025-10-08T05:32:12.472Z
Modified
2026-07-08T07:16:31.373291058Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
JhumanJ OpnForm answer unrestricted upload
Details

A vulnerability was detected in JhumanJ OpnForm up to 1.9.3. Affected by this issue is some unknown functionality of the file /answer. The manipulation results in unrestricted upload. The attack can be launched remotely. The exploit is now public and may be used. The patch is identified as 95c3e23856465d202e6aec10bdb6ee0688b5305a. It is advisable to implement a patch to correct this issue.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11436.json",
    "cwe_ids": [
        "CWE-284",
        "CWE-434"
    ],
    "cna_assigner": "VulDB"
}
References

Affected packages

Git / github.com/OpnForm/OpnForm

Affected ranges

Type
GIT
Repo
https://github.com/OpnForm/OpnForm
Events
Introduced
6dcdd954776ab856d9b0d9e47df441f87304e79f
Last affected
7fcfc727bdb1d9915e87d7da4901bd02187f8f4b
Database specific 
{
    "extracted_events": [
        {
            "introduced": "1.9.0"
        },
        {
            "last_affected": "1.9.0"
        },
        {
            "introduced": "1.9.1"
        },
        {
            "last_affected": "1.9.1"
        },
        {
            "introduced": "1.9.2"
        },
        {
            "last_affected": "1.9.2"
        },
        {
            "introduced": "1.9.3"
        },
        {
            "last_affected": "1.9.3"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*
1.9.0
1.9.1
1.9.2
1.9.3
v1.*
v1.9.0
v1.9.1
v1.9.2
v1.9.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-11436.json"