What is the CVSS score of EUVD-2025-209773?

EUVD-2025-209773 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of docuForm MPS are affected by EUVD-2025-209773?

docuForm Managed Print Services 11.11c contains a reflected cross-site scripting vulnerability that allows authenticated attackers to hijack user sessions and compromise accounts through malicious…

How to fix or mitigate EUVD-2025-209773?

Within 24 hours: Identify all docuForm MPS 11.11c deployments and notify users of the attack vector (malicious links in email/messages). Within 7 days: Implement network segmentation to restrict dfm-menu_orderopt.php access to trusted internal networks only; deploy Web Application Firewall (WAF) rules to block requests with suspicious parameter encoding in the affected component. Within 30 days: Contact docuForm vendor for patch timeline; evaluate migration to a patched version if available, or replace the solution with alternative managed print service software that is actively maintained.

docuForm MPS EUVD-2025-209773

| CVE-2025-61314 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-11 mitre

GHSA-r348-8ppg-53fc

XSS PHP

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

May 11, 2026 - 20:38 vuln.today

CVSS changed

May 11, 2026 - 20:37 NVD

7.3 (HIGH)

CVE Published

May 11, 2026 - 00:00 nvd

HIGH 7.3

CVE Published

May 11, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

A reflected cross-site scripted (XSS) vulnerability in the dfm-menu_orderopt.php component of GmbH Mecury Managed Print Services (docuForm) v11.11c allows attackers to execute arbitrary Javascript in the context of a user's browser via injecting a crafted payload into an unfiltered variable value.

AnalysisAI

Reflected XSS in docuForm Managed Print Services 11.11c enables authenticated attackers to execute malicious JavaScript in victim browsers via crafted links. The dfm-menu_orderopt.php component fails to sanitize input parameters, allowing session hijacking and account takeover when low-privilege users click attacker-controlled URLs. EPSS data unavailable; no CISA KEV listing indicates exploitation remains opportunistic rather than widespread. Public exploit code exists via GitHub Gist, lowering barrier to attack.

Technical ContextAI

This is a classic reflected cross-site scripting vulnerability (CWE-79) in a PHP-based print management web application. The dfm-menu_orderopt.php component accepts user-supplied input through URL parameters or form fields without proper output encoding or sanitization. When an authenticated user accesses a malicious URL, the application reflects the attacker-controlled payload directly into the HTML response, causing the victim's browser to execute arbitrary JavaScript. The vulnerability exists in docuForm version 11.11c, a managed print services solution by GmbH Mecury. The CPE string in NVD is generic (n/a) indicating incomplete product cataloging, but vendor and GitHub references confirm the specific product and version. Reflected XSS differs from stored XSS in that the malicious script is not persisted server-side but instead delivered through social engineering each time.

RemediationAI

No vendor-released patch or fixed version is identified in the available data. Organizations should immediately contact GmbH Mecury through docuform.de to request security updates for version 11.11c. Until a patch is available, implement these compensating controls: Deploy a web application firewall (WAF) with XSS signature detection to filter malicious payloads in HTTP parameters - note this may cause false positives with legitimate special characters in print job names. Enable Content Security Policy (CSP) headers with 'script-src self' to prevent inline JavaScript execution - test thoroughly as this may break existing functionality if the application relies on inline scripts. Restrict access to the docuForm web interface to trusted internal networks only using IP allowlisting or VPN requirements - this eliminates remote attack vector but does not protect against insider threats. Train users to avoid clicking untrusted links to the docuForm system, especially those containing unusual URL parameters. Monitor application logs for suspicious patterns in dfm-menu_orderopt.php requests containing script tags or JavaScript event handlers. The GitHub Gist at https://gist.github.com/ZeroBreach-GmbH/4386b61523d784d2ffc674299ed02d51 likely contains POC details - review it to understand specific parameter names requiring filtering.