What is the CVSS score of CVE-2025-61305?

CVE-2025-61305 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

docuForm Managed Print Services CVE-2025-61305

EUVD-2025-209763 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-11 mitre

GHSA-qx6h-jm33-qfch

XSS PHP

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 11, 2026 - 20:38 vuln.today

CVSS changed

May 11, 2026 - 20:37 NVD

6.1 (MEDIUM)

CVE Published

May 11, 2026 - 00:00 nvd

MEDIUM 6.1

CVE Published

May 11, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

A reflected cross-site scripted (XSS) vulnerability in the dfm-menu_firmware.php component of GmbH Mecury Managed Print Services (docuForm) v11.11c allows attackers to execute arbitrary Javascript in the context of a user's browser via injecting a crafted payload into an unfiltered variable value.

AnalysisAI

Reflected XSS in docuForm v11.11c allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious payloads into the dfm-menu_firmware.php component, requiring the victim to click a crafted link. CVSS 6.1 reflects moderate impact (confidentiality and integrity compromise) with required user interaction. Exploit code is publicly available via GitHub.

Technical ContextAI

The vulnerability exists in the dfm-menu_firmware.php file, a PHP component of docuForm's Managed Print Services platform. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Reflected XSS), indicating that user-supplied input is directly reflected in HTTP responses without sanitization or encoding. The attack vector is network-based with low complexity, exploiting standard HTTP GET/POST parameters. The unfiltered variable value referenced in the description is not HTML-encoded before being output to the client, allowing attackers to break out of the HTML/JavaScript context and inject arbitrary script tags or event handlers.

RemediationAI

Immediately upgrade docuForm to a patched version released by GmbH Mecury (specific patch version not confirmed in available data - contact vendor or check https://www.docuform.de/ for the latest release). As an interim workaround pending patch availability, implement the following compensating controls: (1) Disable or restrict access to the dfm-menu_firmware.php endpoint using web application firewall rules or HTTP authentication, accepting the trade-off that legitimate firmware management functionality will be unavailable until patched; (2) Apply input validation/output encoding at the web server level using ModSecurity or similar WAF rules to reject payloads containing script tags, event handlers, or other XSS vectors in all parameters to dfm-menu_firmware.php; (3) Enforce HTTP-only and SameSite=Strict flags on session cookies to reduce the impact of successful XSS attacks, preventing JavaScript access to authentication tokens; (4) Deploy a Content Security Policy (CSP) header restricting script execution to only trusted sources, mitigating inline script injection. These mitigations reduce but do not eliminate risk - patching remains mandatory.