CVE-2025-61305
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A reflected cross-site scripting (XSS) vulnerability in the dfm-menu_firmware.php component of GmbH Mecury Managed Print Services (docuForm) v11.11c allows attackers to execute arbitrary JavaScript in the context of a user's browser via injecting a crafted payload into an unfiltered variable value.
Risk Assessment
Session hijacking, data theft, or actions performed in the victim's browser context are possible, potentially compromising confidentiality and integrity.
Recommendation
Update docuForm to a patched version or implement input validation and encoding for variables in dfm-menu_firmware.php. Consider deploying CSP headers.
Other vulnerabilities in docuForm
See all- CVE-2025-61310Medium
A reflected cross-site scripting (XSS) vulnerability in the acc-menu_billings.php component of GmbH Mecury Managed Print Services (docuForm) v11.11c allows attackers to execute arbitrary JavaScript in the context of a user's browser via injecting a crafted payload into an unfiltered variable value.
- CVE-2025-61309Medium
A reflected cross-site scripting (XSS) vulnerability in the dfm-menu_departments.php component of GmbH Mecury Managed Print Services (docuForm) v11.11c allows attackers to execute arbitrary JavaScript in the context of a user's browser via injecting a crafted payload into an unfiltered variable value.
- CVE-2025-61308Medium
A reflected cross-site scripting (XSS) vulnerability in the dfm-menu_maintenance.php component of GmbH Mecury Managed Print Services (docuForm) v11.11c allows attackers to execute arbitrary JavaScript in the context of a user's browser via injecting a crafted payload into an unfiltered variable value.
- CVE-2025-61307Medium
A reflected cross-site scripting (XSS) vulnerability in the acc-menu_papers.php component of GmbH Mecury Managed Print Services (docuForm) v11.11c allows attackers to execute arbitrary JavaScript in the context of a user's browser via injecting a crafted payload into an unfiltered variable value.
- CVE-2025-61306Medium
A reflected cross-site scripting (XSS) vulnerability in the dfm-menu_coveragealerts.php component of GmbH Mecury Managed Print Services (docuForm) v11.11c allows attackers to execute arbitrary JavaScript in the context of a user's browser via injecting a crafted payload into an unfiltered variable value.
Original NVD description (English source)
A reflected cross-site scripted (XSS) vulnerability in the dfm-menu_firmware.php component of GmbH Mecury Managed Print Services (docuForm) v11.11c allows attackers to execute arbitrary Javascript in the context of a user's browser via injecting a crafted payload into an unfiltered variable value.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS