Cross Site Scripting Vulnerability in JhumanJ OpnForm Client Application
CVE-2025-11435

5.3MEDIUM

Key Information:

Vendor

Jhumanj

Status
Opnform
Vendor
CVE Published:
8 October 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-11435?

A security vulnerability has been identified in the JhumanJ OpnForm client application that allows for cross site scripting (XSS) attacks. This vulnerability affects the functionality associated with the /show/submissions endpoint, enabling attackers to execute malicious scripts in the context of a user's session. The exploitation can be performed remotely, which poses a significant risk if applications using this version are not properly secured. A patch has been released to fix this issue and is available for deployment.

Affected Version(s)

OpnForm 1.9.0

OpnForm 1.9.1

OpnForm 1.9.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-11435 - Proof of Concept

References

https://vuldb.com/?id.327372
vdb-entry
https://vuldb.com/?ctiid.327372
signaturepermissions-required
https://vuldb.com/?submit.666876
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

balejin (VulDB User)
JSON
.
CVE-2025-11435 : Cross Site Scripting Vulnerability in JhumanJ OpnForm Client Application