Reflected XSS in Mecury Managed Print Services docuForm

Compliance Impact

The reflected cross-site scripting (XSS) vulnerability in docuForm FSM Server version 11.11c allows attackers to execute arbitrary JavaScript in users' browsers, which can lead to session hijacking, theft of sensitive data, unauthorized account takeover, or unintended actions on behalf of victims.

Such security weaknesses can impact compliance with common standards and regulations like GDPR and HIPAA, as these frameworks require protection of personal and sensitive data against unauthorized access and breaches.

Failure to address this vulnerability could result in exposure of sensitive user information, potentially leading to violations of data protection requirements and regulatory penalties.

Useful 0 Not Useful 0

Executive Summary

CVE-2025-61312 is a cross-site scripting (XSS) vulnerability in the acc-menu_pricess.php component of GmbH Mecury Managed Print Services (docuForm) version 11.11c. It allows attackers to inject arbitrary JavaScript code by exploiting improper neutralization of user-controllable input. This injected code can then be executed in the context of a user's browser.

Specifically, an authenticated attacker can inject malicious scripts that are stored by the application and later rendered unsafely in other users' browsers, leading to potential security risks.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts including session hijacking, theft of sensitive data, unauthorized account takeover, and performing unintended actions on behalf of victims.

Because the malicious JavaScript runs in the context of other users' browsers, attackers can steal cookies, credentials, or other sensitive information, compromising user accounts and data security.

Useful 0 Not Useful 0

Mitigation Strategies

The vendor has acknowledged the vulnerability and released a fix in November 2025. The immediate step to mitigate this vulnerability is to apply the vendor's patch or update for docuForm FSM Server version 11.11c that addresses the XSS issue in the acc-menu_pricess.php component.

Additionally, as a general best practice, you should ensure proper input validation and output encoding to prevent injection of malicious scripts.

Useful 0 Not Useful 0