What is the CVSS score of CVE-2025-61310?

CVE-2025-61310 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

docuForm CVE-2025-61310

EUVD-2025-209769 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-11 mitre

GHSA-8r9m-qcx2-r433

XSS PHP

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 11, 2026 - 20:39 vuln.today

CVSS changed

May 11, 2026 - 20:37 NVD

6.1 (MEDIUM)

CVE Published

May 11, 2026 - 00:00 nvd

MEDIUM 6.1

CVE Published

May 11, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

A reflected cross-site scripted (XSS) vulnerability in the acc-menu_billings.php component of GmbH Mecury Managed Print Services (docuForm) v11.11c allows attackers to execute arbitrary Javascript in the context of a user's browser via injecting a crafted payload into an unfiltered variable value.

AnalysisAI

Reflected XSS in docuForm v11.11c acc-menu_billings.php component allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious payloads into unfiltered variables, requiring user interaction to click a crafted link. CVSS 6.1 reflects limited confidentiality and integrity impact with required user interaction, but successful exploitation can lead to session hijacking, credential theft, or account takeover depending on application context.

Technical ContextAI

The vulnerability exists in the acc-menu_billings.php file of docuForm, a GmbH Mercury Managed Print Services platform. The root cause (CWE-79: Improper Neutralization of Input During Web Page Generation) indicates that user-supplied input is directly reflected in HTTP responses without sanitization or encoding. The PHP component fails to implement input validation or output encoding (e.g., htmlspecialchars, Content-Security-Policy headers) before rendering variable values into HTML context. This allows attackers to break out of HTML attribute or tag context and inject script tags or event handlers that execute in the victim's browser under the application's origin.

RemediationAI

Upgrade docuForm to a patched version released by GmbH Mercury addressing CVE-2025-61310; vendor confirmation of the fixed version is required. Pending patch availability, implement input validation by whitelisting expected variable formats in acc-menu_billings.php and output encoding using PHP htmlspecialchars() or htmlentities() with ENT_QUOTES flag for all user-supplied variables rendered in HTML context. Deploy Content-Security-Policy headers (e.g., script-src 'self'; img-src 'self') to restrict inline script execution, mitigating reflected XSS impact. Configure SameSite=Strict or SameSite=Lax on session cookies to reduce session hijacking risk if XSS is exploited. Monitor docuForm's official website (https://www.docuform.de/) and the NIST NVD (https://nvd.nist.gov/vuln/detail/CVE-2025-61310) for patch release announcements. These compensating controls reduce but do not eliminate XSS risk and may impact legitimate AJAX or cross-origin functionality; test thoroughly before production deployment.