CVE-2025-11441

A vulnerability was identified in JhumanJ OpnForm up to 1.9.3. The affected element is an unknown function of the component HTTP Header Handler. The manipulation of the argument X-Forwarded-For leads to improper restriction of excessive authentication attempts. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitability is described as difficult. The exploit is publicly available and might be used. The identifier of the patch is 11e99960e14ca986b1a001a56e7533223d2cfa5b. It is suggested to install a patch to address this issue.

• CWE-307
• CWE-799

• https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.va2ituwwqcf3Exploit, Third Party Advisory
• https://github.com/JhumanJ/OpnForm/pull/900/commits/11e99960e14ca986b1a001a56e7533223d2cfa5bPatch
• https://vuldb.com/?ctiid.327378Permissions Required, VDB Entry
• https://vuldb.com/?id.327378Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.666888Third Party Advisory, VDB Entry
• https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.va2ituwwqcf3Exploit, Third Party Advisory

Published

Oct 8, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-11436A vulnerability was detected in JhumanJ OpnForm up to 1.9.3.…8.8
• CVE-2025-11437A flaw has been found in JhumanJ OpnForm up to 1.9.3. This a…4.8
• CVE-2025-11438A vulnerability has been found in JhumanJ OpnForm up to 1.9.…6.3
• CVE-2025-11439A vulnerability was found in JhumanJ OpnForm up to 1.9.3. Th…4.3
• CVE-2025-1144School Affairs System from Quanxun has an Exposure of Sensit…9.8
• CVE-2025-11440A vulnerability was determined in JhumanJ OpnForm up to 1.9.…4.3
• CVE-2025-11442A security flaw has been discovered in JhumanJ OpnForm up to…4.3
• CVE-2025-11443A weakness has been identified in JhumanJ OpnForm up to 1.9.…5.9
• CVE-2025-11444A security vulnerability has been detected in TOTOLINK N600R…8.8
• CVE-2025-11445A vulnerability was detected in Kilo Code up to 4.86.0. Affe…6.3
• CVE-2025-11446Insertion of Sensitive Information into Log File vulnerabili…6.5
• CVE-2025-11447GitLab has remediated an issue in GitLab CE/EE affecting all…7.5