A reflected cross‑site scripting vulnerability exists in the dfm-menu_firmware.php component of GmbH Mecury Managed Print Services (docuForm). The flaw allows an attacker to inject a crafted payload into an unfiltered variable value, which is then reflected back into the browser response, enabling arbitrary Javascript execution in the context of the victim’s session. This could be used for session hijacking, defacement, or delivery of malicious scripts to the user.

Affected is docuForm version 11.11c, the firmware menu component. No other vendors, products or versions are listed.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly reported exploitation yet. The CVSS score of 6.1 indicates medium severity. Reflected XSS remains a medium severity risk because it can be triggered by a user visiting a crafted URL or interacting with a malicious link. Attackers would need to lure the target to a page containing the malicious payload or exploit it via social engineering.