What is the CVSS score of CVE-2025-61308?

CVE-2025-61308 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

docuForm Managed Print Services CVE-2025-61308

EUVD-2025-209767 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-11 mitre

GHSA-4638-9784-5w54

XSS PHP

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 11, 2026 - 20:38 vuln.today

CVSS changed

May 11, 2026 - 20:37 NVD

6.1 (MEDIUM)

CVE Published

May 11, 2026 - 00:00 nvd

MEDIUM 6.1

CVE Published

May 11, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

A reflected cross-site scripted (XSS) vulnerability in the dfm-menu_maintenance.php component of GmbH Mecury Managed Print Services (docuForm) v11.11c allows attackers to execute arbitrary Javascript in the context of a user's browser via injecting a crafted payload into an unfiltered variable value.

AnalysisAI

Reflected cross-site scripting (XSS) in GmbH Mercury docuForm v11.11c allows remote attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious payloads into an unfiltered variable in the dfm-menu_maintenance.php component. The vulnerability requires user interaction (clicking a crafted link) but affects all site visitors, making it suitable for credential theft, session hijacking, or malware delivery. No public active exploitation has been confirmed at time of analysis.

Technical ContextAI

The vulnerability exists in the dfm-menu_maintenance.php component, a PHP-based admin or maintenance interface within docuForm's web application. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), indicating that user-supplied input is reflected directly into HTML output without sanitization or encoding. The affected variable is not HTML-entity-encoded, CSS-escaped, or JavaScript-escaped before being inserted into the page, allowing an attacker to break out of the intended context and inject arbitrary script tags or event handlers. This is a classic reflected XSS vulnerability pattern in PHP web applications where input validation and output encoding are absent.

RemediationAI

Upgrade to a patched version of docuForm released by GmbH Mercury after version 11.11c. Contact the vendor at https://www.docuform.de/ to obtain the latest security release, as specific patch version numbers are not provided in available advisories. Interim compensating controls include: (1) implement a Web Application Firewall (WAF) with XSS signature detection on the dfm-menu_maintenance.php endpoint to block payloads containing script tags or event handlers, with the trade-off that legitimate use of special characters in variables may be blocked; (2) deploy Content Security Policy (CSP) headers with script-src 'self' to prevent execution of injected scripts from external sources or inline event handlers, noting that this requires ensuring all legitimate scripts are hosted locally; (3) restrict network access to the maintenance interface via IP allowlisting if the component is intended for admin-only use; (4) educate users not to click suspicious links referencing the docuForm application, as user interaction is required for exploitation. Monitor vendor security bulletins for patch availability and apply it as soon as testing permits.