The vulnerability is a reflected cross‑site scripting flaw located in the dfm‑menu_maintenance.php component of docuForm. The flaw arises when the application reflects user‑supplied data into the page without proper filtering or escaping. Attackers can inject crafted JavaScript that is executed in the context of any user who views the affected page. This gives an attacker the ability to run arbitrary scripts, potentially hijack user sessions, steal credentials, modify page content, or carry out further attacks within the victim’s browser.

The affected product is docuForm version 11.11c from the GmbH Mecury Managed Print Services family. All installations of docuForm 11.11c that expose the dfm‑menu_maintenance.php component are vulnerable unless patched or otherwise mitigated.

The CVSS score of 6.1 indicates a moderate severity, while the EPSS score is not available. The vulnerability is also not listed in the CISA KEV catalog. Nevertheless, reflected XSS is a high‑risk weakness that is usually trivial to exploit by sending a crafted URL or form input to a user. The attack is client‑side and requires only that a user opens a malicious link or interacts with the vulnerable page. Because the flaw is discovered through an unfiltered variable, the exploitation probability is unlikely to be constrained by additional checks, making this flaw a serious threat in environments where docuForm is deployed.