The reported issue is a reflected cross‑site scripting flaw in the acc‑menu_papers.php component of docuForm version 11.11c. An attacker can inject malicious JavaScript into an unfiltered variable value that is later rendered back to the user’s browser. This allows arbitrary script execution in the victim’s context, potentially enabling cookie theft, session hijacking, defacement, or the execution of any other browser‑based attack.

The flaw is limited to the GmbH Mecury Managed Print Services docuForm application, specifically version 11.11c. No other versions or vendor products are identified in the advisory. Administrators should verify that their deployed instance matches this version before taking action.

No EPSS score is published, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 6.1 indicates moderate severity, but the nature of a reflected XSS means it can be triggered by any user who visits a crafted URL or interacts with the affected module, without authentication. The low complexity of the exploitation, combined with the broad impact on all users of the affected component, places this vulnerability in a moderate risk category for environments where the application is publicly accessible.