What is the CVSS score of CVE-2025-61313?

CVE-2025-61313 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Mercury docuForm are affected by CVE-2025-61313?

Mercury docuForm v11.11c contains a reflected cross-site scripting vulnerability that allows authenticated users to execute malicious scripts in victim browsers through crafted links, potentially…

How to fix or mitigate CVE-2025-61313?

Within 24 hours: Identify all Mercury docuForm v11.11c instances in your environment and restrict administrative access to dfm-menu_markeralerts.php; document current user authentication logs. Within 7 days: implement network-level controls to restrict docuForm access to internal networks only and deploy Web Application Firewall rules to filter script injection attempts in the affected parameter. Within 30 days: contact Mercury support for patch availability timeline; evaluate migration to patched version upon release or alternative MPS solutions if patch timeline exceeds acceptable risk window.

Mercury docuForm CVE-2025-61313

EUVD-2025-209772 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-11 mitre

GHSA-946m-6f62-24f5

XSS PHP

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

May 11, 2026 - 20:37 vuln.today

CVSS changed

May 11, 2026 - 20:37 NVD

7.3 (HIGH)

CVE Published

May 11, 2026 - 00:00 nvd

HIGH 7.3

CVE Published

May 11, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

A reflected cross-site scripted (XSS) vulnerability in the dfm-menu_markeralerts.php component of GmbH Mecury Managed Print Services (docuForm) v11.11c allows attackers to execute arbitrary Javascript in the context of a user's browser via injecting a crafted payload into an unfiltered variable value.

AnalysisAI

Reflected cross-site scripting in Mercury docuForm (Managed Print Services) v11.11c enables authenticated attackers to execute arbitrary JavaScript in victim browsers when users click malicious links. The vulnerability exists in dfm-menu_markeralerts.php due to unfiltered variable handling. CVSS 7.3 (High) reflects network-accessible attack requiring low-privilege authentication and user interaction. No public exploit confirmed, but proof-of-concept code published by ZeroBreach GmbH demonstrates feasibility. EPSS data unavailable; not in CISA KEV, indicating no confirmed widespread exploitation at time of analysis.

Technical ContextAI

The vulnerability is a classic reflected XSS (CWE-79) in a PHP-based managed print services application. The dfm-menu_markeralerts.php component fails to sanitize user-supplied input before reflecting it in HTTP responses, allowing JavaScript injection. Reflected XSS differs from stored XSS in that the malicious payload is not persisted server-side but rather delivered via crafted URLs or form submissions. The attack succeeds when the application echoes unsanitized input directly into HTML contexts without proper encoding. CPE data is incomplete (cpe:2.3:a:n/a:n/a), suggesting limited automated tooling coverage for this niche enterprise print management software. The PHP tag indicates standard web application stack vulnerabilities.

RemediationAI

No vendor-released patch identified at time of analysis. The vendor website (https://www.docuform.de/) should be monitored for security bulletins. Immediate compensating controls include implementing web application firewall (WAF) rules to detect and block common XSS patterns in requests to dfm-menu_markeralerts.php (trade-off: may cause false positives blocking legitimate special characters in marker alert names). Restrict access to the affected component using network ACLs or reverse proxy authentication to trusted IP ranges only (trade-off: reduces usability for remote workers). Implement Content Security Policy (CSP) headers with 'script-src self' directive to prevent execution of injected JavaScript (trade-off: may break legitimate inline scripts if application relies on them). Train users to recognize and avoid clicking suspicious links to docuForm URLs. Review application logs for requests to dfm-menu_markeralerts.php containing script tags, event handlers, or JavaScript protocol handlers as indicators of exploitation attempts.