CVE-2025-11436: jhumanj opnform

csirt@kutim:~/threat-intel/cve/CVE-2025-11436

CVSS 8.8 · High EPSS 0,38%

Kerentanan Improper Access Control pada jhumanj opnform. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability was detected in JhumanJ OpnForm up to 1.9.3. Affected by this issue is some unknown functionality of the file /answer. The manipulation results in unrestricted upload. The attack can be launched remotely. The exploit is now public and may be used. The patch is identified as 95c3e23856465d202e6aec10bdb6ee0688b5305a. It is advisable to implement a patch to correct this issue.

Rincian

Terbit di NVD: 8 Oktober 2025
Terakhir diubah: 8 Oktober 2026
Status NVD: Analyzed
CVSS 3.1: 8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-284: Improper Access Control
CWE-434: Unrestricted Upload of File with Dangerous Type
EPSS (30 hari): 0,38% peluang dieksploitasi; lebih tinggi dari 29,8% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
jhumanj	opnform	Semua versi hingga 1.9.3

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/JhumanJ/OpnForm/pull/900/commits/95c3e23856465d202e6aec10bdb6ee0688b5305a patch
https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.dm5ttli... exploit · advisory pihak ketiga
https://vuldb.com/?id.327373 advisory pihak ketiga · vdb entry
https://vuldb.com/?submit.666877 advisory pihak ketiga · vdb entry
https://vuldb.com/?ctiid.327373 permissions required · vdb entry

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 9 Okt 2026, 00:26 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.