CVE-2025-11436

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-11436
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-11436.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-11436
Published
2025-10-08T06:15:34.883Z
Modified
2026-04-10T05:21:38.743278Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

A vulnerability was detected in JhumanJ OpnForm up to 1.9.3. Affected by this issue is some unknown functionality of the file /answer. The manipulation results in unrestricted upload. The attack can be launched remotely. The exploit is now public and may be used. The patch is identified as 95c3e23856465d202e6aec10bdb6ee0688b5305a. It is advisable to implement a patch to correct this issue.

References

Affected packages

Git / github.com/jhumanj/opnform

Affected ranges

Type
GIT
Repo
https://github.com/jhumanj/opnform
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
7fcfc727bdb1d9915e87d7da4901bd02187f8f4b
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.9.3"
        }
    ]
}

Affected versions

1.*
1.3.0
v1.*
v1.0.1
v1.1.1
v1.1.2
v1.1.3
v1.1.4
v1.2.1
v1.2.2
v1.2.3
v1.2.4
v1.2.5
v1.2.6
v1.3.0
v1.3.2
v1.3.3
v1.3.4
v1.3.5
v1.3.6
v1.3.7
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.4.4
v1.4.5
v1.5
v1.6
v1.6.1
v1.6.2
v1.6.3
v1.6.4
v1.6.5
v1.6.6
v1.7.0
v1.7.1
v1.7.3
v1.8.0
v1.9.0
v1.9.1
v1.9.2
v1.9.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-11436.json"