What is the CVSS score of CVE-2025-61311?

CVE-2025-61311 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of docuForm Managed Print Services are affected by CVE-2025-61311?

Mercury docuForm v11.11c contains a reflected cross-site scripting vulnerability (CVE-2025-61311) that allows authenticated users to execute arbitrary JavaScript in victim browsers through malicious…

How to fix or mitigate CVE-2025-61311?

Within 24 hours: identify all instances of Mercury docuForm v11.11c in your environment and restrict access to dfm-menu_alerts.php to privileged administrators only via firewall or application-level controls. Within 7 days: issue security awareness notice to all docuForm users regarding phishing risks and suspicious links, and log all access to the affected endpoint for forensic review. Within 30 days: contact Mercury vendor for patch availability and timeline; evaluate alternative document management solutions or compensating controls if patch release is delayed beyond 60 days.

docuForm Managed Print Services CVE-2025-61311

EUVD-2025-209770 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-11 mitre

GHSA-x4w9-563f-6h62

XSS PHP

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

May 11, 2026 - 20:37 vuln.today

CVSS changed

May 11, 2026 - 20:37 NVD

7.3 (HIGH)

CVE Published

May 11, 2026 - 00:00 nvd

HIGH 7.3

CVE Published

May 11, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

A reflected cross-site scripted (XSS) vulnerability in the dfm-menu_alerts.php component of GmbH Mecury Managed Print Services (docuForm) v11.11c allows attackers to execute arbitrary Javascript in the context of a user's browser via injecting a crafted payload into an unfiltered variable value.

AnalysisAI

Reflected cross-site scripting in Mercury docuForm v11.11c allows authenticated attackers to execute arbitrary JavaScript in victim browsers via crafted payloads to dfm-menu_alerts.php. Attack requires low complexity and user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:R). Public proof-of-concept exists on GitHub (ZeroBreach-GmbH gist), but no CISA KEV listing indicates targeted or low-volume exploitation. EPSS data not available, but the authentication requirement and user interaction dependency reduce attack surface compared to stored XSS.

Technical ContextAI

This is a reflected XSS vulnerability (CWE-79) in dfm-menu_alerts.php, a PHP component of Mercury GmbH's docuForm Managed Print Services. Reflected XSS occurs when untrusted user input is immediately returned in HTTP responses without proper sanitization or output encoding. The dfm-menu_alerts.php component accepts variable values without filtering or encoding, allowing attackers to inject JavaScript payloads that execute when victims view the crafted URL. Unlike stored XSS, reflected attacks require delivering malicious links to targets. The PHP-based application likely lacks server-side input validation and browser-side output encoding for the affected parameter in dfm-menu_alerts.php.

RemediationAI

Upgrade to a patched version of Mercury docuForm if available; contact vendor at docuform.de for security updates addressing CVE-2025-61311. No vendor security advisory or patched version number is identified in available references. Until a patch is deployed, implement compensating controls: apply output encoding using htmlspecialchars() or equivalent for all user input reflected in dfm-menu_alerts.php responses; implement Content Security Policy (CSP) headers with 'script-src self' to block inline JavaScript execution (may break legitimate application features requiring inline scripts); enforce strict input validation on all parameters accepted by dfm-menu_alerts.php, rejecting requests containing script tags or JavaScript event handlers; deploy Web Application Firewall (WAF) rules to detect and block XSS patterns in requests to the affected component (high false-positive risk without tuning). Review the proof-of-concept at https://gist.github.com/ZeroBreach-GmbH/424005738e819e14c724feb9c7c5f40b to identify specific vulnerable parameters and prioritize remediation. Educate authenticated users about phishing risks and suspicious links targeting docuForm URLs.