CVE-2025-11435 Overview
CVE-2025-11435 is a cross-site scripting (XSS) vulnerability in JhumanJ OpnForm through version 1.9.3. The flaw affects unknown functionality within the /show/submissions endpoint. Attackers can manipulate input to inject malicious script content that executes in the context of the victim's browser session. The vulnerability is exploitable remotely and requires user interaction to trigger. Public disclosure of exploit details has occurred, increasing the risk of opportunistic abuse. The issue is tracked under [CWE-79] and has been patched upstream via commit a2af1184e53953afa8cb052f4055f288adcaa608.
Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in the browser of users viewing OpnForm submissions, enabling session theft, credential harvesting, or actions on behalf of authenticated users.
Affected Products
- JhumanJ OpnForm versions up to and including 1.9.3
- Deployments exposing the /show/submissions endpoint
- Self-hosted OpnForm instances without the referenced patch applied
Discovery Timeline
- 2025-10-08 - CVE-2025-11435 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-11435
Vulnerability Analysis
The vulnerability resides in the /show/submissions component of OpnForm, an open-source form-building application maintained by JhumanJ. Submitted form data is rendered back to viewers without sufficient output encoding. Attackers can submit payloads containing HTML or JavaScript that the application later reflects into the submissions display view.
When an authorized user, such as a form owner or administrator, loads the submissions page, the injected script executes in their browser. This grants the attacker access to whatever the victim's session permits, including form data, authentication tokens stored client-side, and administrative form actions. The attack requires no privileges on the attacker's side because form submission is typically open to unauthenticated users.
Root Cause
The root cause is missing or inadequate output sanitization when displaying user-supplied submission content. The application trusts stored submission fields and renders them directly into the HTML response. This falls under [CWE-79], Improper Neutralization of Input During Web Page Generation. The upstream fix in commit a2af1184e53953afa8cb052f4055f288adcaa608 introduces proper encoding for affected fields.
Attack Vector
An attacker submits a form containing a JavaScript payload in one of the input fields. The malicious content persists in the OpnForm database. When a legitimate user visits /show/submissions to review responses, the payload executes in their browser context. The attack vector is network-based, requires no authentication from the attacker, but does require user interaction from the victim viewing the submissions view.
See the VulDB CVE Analysis for additional technical context.
Detection Methods for CVE-2025-11435
Indicators of Compromise
- Form submission records containing <script>, javascript:, onerror=, or onload= payloads in text fields
- Unexpected outbound HTTP requests from browsers of users who viewed the submissions page
- New or modified administrative forms and workflow settings following submissions review by privileged accounts
Detection Strategies
- Inspect stored form submissions for HTML tags or JavaScript event handlers in fields that should contain only plain text
- Review web server access logs for requests to /show/submissions correlated with subsequent anomalous API calls from the same session
- Monitor Content Security Policy (CSP) violation reports if CSP is enforced against the OpnForm frontend
Monitoring Recommendations
- Enable verbose HTTP logging on the OpnForm application server to capture full submission payloads
- Alert on form submissions containing common XSS keywords or encoded script indicators such as %3Cscript or <script
- Track administrator session activity for unusual behavior immediately after loading the submissions view
How to Mitigate CVE-2025-11435
Immediate Actions Required
- Apply the upstream patch from commit a2af1184e53953afa8cb052f4055f288adcaa608 or upgrade to a fixed OpnForm release beyond version 1.9.3
- Audit existing form submissions for stored XSS payloads and purge malicious entries
- Restrict access to the submissions view to trusted accounts pending remediation
Patch Information
The maintainers released a fix via GitHub Pull Request Commits. Operators of self-hosted OpnForm instances should rebuild their deployment from the patched source or pull the updated Docker image once available. Verify the patch commit hash matches a2af1184e53953afa8cb052f4055f288adcaa608 after deployment.
Workarounds
- Deploy a Content Security Policy that disallows inline script execution on OpnForm pages until the patch is applied
- Place OpnForm behind a web application firewall (WAF) with rules to strip HTML tags and script indicators from form submission requests
- Educate administrators to avoid opening submissions from untrusted or public-facing forms until remediation is complete
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
