CVE-2025-61307 GmbH Mecury CVE debrief

Who should care

Defenders responsible for GmbH Mecury Managed Print Services (docuForm) v11.11c deployments should assess the risk of XSS attacks and prioritize verification and remediation efforts.

Why it matters

CVE-2025-61307 is a reflected cross-site scripting (XSS) vulnerability in GmbH Mecury Managed Print Services (docuForm) v11.11c. Defenders should prioritize verifying the presence of this vulnerability, assessing the risk of XSS attacks, and implementing input validation and output encoding to prevent XSS.

• Potential for arbitrary Javascript execution in user browsers
• Risk of XSS attacks against users of vulnerable deployments
• Need for input validation and output encoding to prevent XSS
• Verification priority for GmbH Mecury Managed Print Services (docuForm) v11.11c deployments

Technical summary

The acc-menu_papers.php component of GmbH Mecury Managed Print Services (docuForm) v11.11c is vulnerable to reflected cross-site scripting (XSS). Attackers can inject crafted payloads into unfiltered variable values, potentially leading to arbitrary Javascript execution in the context of a user's browser. The vulnerability has a CVSS score of 6.1 and is classified as MEDIUM severity. Defenders should prioritize verifying the presence of this vulnerability in their environments, especially if they use GmbH Mecury Managed Print Services (docuForm) v11.11c, and assess the risk of XSS attacks. The CVE record and NVD entry provide details about the vulnerability, but further verification from official sources is

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their environments, especially if they use GmbH Mecury Managed Print Services (docuForm) v11.11c, and assess the risk of XSS attacks.

Recommended defensive actions

• Verify the presence of GmbH Mecury Managed Print Services (docuForm) v11.11c in your environment
• Assess the risk of XSS attacks
• Implement input validation and output encoding to prevent XSS
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its CVSS score of 6.1 and MEDIUM severity. However, the actual impact and affected versions require further verification from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.