What is the CVSS score of CVE-2025-61312?

CVE-2025-61312 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Mercury docuForm are affected by CVE-2025-61312?

Mercury Managed Print Services docuForm v11.11c contains a reflected cross-site scripting vulnerability that allows authenticated attackers to execute arbitrary JavaScript in victim browsers through…

How to fix or mitigate CVE-2025-61312?

Within 24 hours: identify all Mercury docuForm v11.11c installations and restrict external access to acc-menu_pricess.php via WAF rules or network segmentation. Within 7 days: disable or isolate the affected docuForm instance if business-critical functions can be maintained through alternate systems, and deploy URL filtering to block known GitHub POC repositories. Within 30 days: contact Mercury for patch availability and timeline; pending vendor patch, implement input validation and output encoding at the application layer, or migrate to a supported docuForm version if available.

Mercury docuForm CVE-2025-61312

EUVD-2025-209771 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-11 mitre

GHSA-rx8w-j3w8-33c5

XSS PHP

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

May 11, 2026 - 20:37 vuln.today

CVSS changed

May 11, 2026 - 20:37 NVD

7.3 (HIGH)

CVE Published

May 11, 2026 - 00:00 nvd

HIGH 7.3

CVE Published

May 11, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

A reflected cross-site scripted (XSS) vulnerability in the acc-menu_pricess.php component of GmbH Mecury Managed Print Services (docuForm) v11.11c allows attackers to execute arbitrary Javascript in the context of a user's browser via injecting a crafted payload into an unfiltered variable value.

AnalysisAI

Reflected cross-site scripting in Mercury Managed Print Services docuForm v11.11c allows authenticated attackers with low privileges to execute arbitrary JavaScript in victim browsers via the acc-menu_pricess.php component. Public proof-of-concept exploit code exists on GitHub (ZeroBreach-GmbH). EPSS data not available, not listed in CISA KEV. Attack requires user interaction (phishing/social engineering to click malicious link), limiting automated exploitation but enabling credential theft and session hijacking for authenticated users.

Technical ContextAI

This is a reflected XSS vulnerability (CWE-79) in a PHP-based print management web application. The acc-menu_pricess.php component fails to sanitize user-supplied input before reflecting it in HTML responses, allowing injection of malicious JavaScript. Reflected XSS differs from stored XSS in that the payload is not persisted on the server - it must be delivered via crafted URL or form submission. The vulnerability exists in Mercury docuForm version 11.11c, a managed print services solution from GmbH Mercury (vendor website: docuform.de). CPE data is incomplete (listed as n/a), but the specific product and version are confirmed in the description. The attack surface is the web interface used by authenticated users for print management tasks.

RemediationAI

No vendor-released patch version identified in available data at time of analysis. Organizations using docuForm v11.11c should contact GmbH Mercury directly via docuform.de for patching guidance and release schedule. Compensating controls until patch deployment: (1) Implement Web Application Firewall (WAF) rules to filter common XSS payloads in HTTP parameters targeting acc-menu_pricess.php - trade-off is potential false positives blocking legitimate special characters in print job names. (2) Restrict access to docuForm web interface to internal networks only via firewall rules, blocking internet exposure - eliminates remote attack vector but prevents legitimate remote administration. (3) Deploy Content Security Policy (CSP) headers with strict script-src directives to prevent inline JavaScript execution - may break legitimate application functionality requiring inline scripts. (4) Enforce multi-factor authentication (MFA) for all docuForm accounts to mitigate credential theft impact from successful XSS attacks. (5) Conduct user security awareness training emphasizing risks of clicking unverified links to print management interfaces. Monitor vendor advisory channels at docuform.de and ZeroBreach.de for patch announcements. Review the proof-of-concept at github.com/ZeroBreach-GmbH/c970fab734432e6f9bc39b2d20f96e5c to understand specific attack patterns for detection rule tuning.