A reflected cross‑site scripting flaw in the dfm‑menu_alerts.php component of GmbH Mecury Managed Print Services (docuForm) allows an attacker to inject arbitrary JavaScript into an unfiltered variable. When the crafted input is reflected back in the page, the script runs in the victim’s browser context, enabling credential theft, session hijacking, defacement, or other client‑side attacks.

Customers running docuForm version 11.11c are affected.

The likely attack vector is an attacker embedding a malicious payload in a link and enticing a user to open it; no server‑side code execution is required. The CVSS score of 7.3 indicates a high risk while the EPSS score is not available. Because the vulnerability succeeds when a user loads the page, the risk is significant for exposed users, especially if the application is accessible over the Internet.