An attacker can craft a URL that injects malicious JavaScript into an unfiltered variable value used by the acc‑menu_pricess.php component. This reflected cross‑site scripting flaw (CWE‑79) allows arbitrary script execution when a victim clicks the link or visits the page, enabling session hijacking, data exfiltration, or further attacks on the user’s behalf.

The vulnerability is present in GmbH Mecury Managed Print Services (docuForm) version 11.11c. No other affected products or versions are listed. The component in question is acc‑menu_pricess.php. Without further documentation, the scope is limited to installations running this specific version of docuForm.

The CVSS score is 7.3, and the EPSS score is unavailable, making the precise risk level unclear. However, the vulnerability is exploitable via a simple crafted link that requires victim interaction, implying a low barrier to initial compromise. Because the flaw allows arbitrary script execution, the impact could be significant if the application handles sensitive data or authentication contexts. The vulnerability is not listed in the CISA KEV catalog, suggesting no widely known or active exploit at the time of disclosure.