The vulnerability is a reflected cross‑site scripting flaw in acc-menu_billings.php of docuForm (GmbH Mecury Managed Print Services) version 11.11c. It allows attackers to execute arbitrary JavaScript in the context of a victim’s browser by injecting a crafted payload into an unfiltered variable value. Because the payload runs with the privileges of the authenticated user, an attacker could hijack sessions, steal cookies, or perform other malicious actions. This flaw corresponds to CWE‑79.

The affected systems are the docuForm Managed Print Services application from GmbH Mecury, specifically version 11.11c. Users of this version who can access the acc-menu_billings.php component are vulnerable to the reflected XSS attack.

The CVSS score is 6.1 and the EPSS score is not listed, nor is the vulnerability in the KEV catalog. Nevertheless, reflected XSS is typically considered high risk, especially in a management platform where authenticated users rely on the software. Based on the description, it is inferred that the attack vector is a victim clicking a crafted URL or viewing a page that includes the malicious payload. Exploit requires no special privileges beyond user access and would result in client‑side JavaScript execution with the potential to hijack user sessions, steal sensitive information, or deface the site.