The CVE is a reflected cross‑site scripting flaw in the dfm-menu_orderopt.php component of docuForm v11.11c. An attacker can supply a crafted payload that is reflected by the application into a browser without any filtering. If a user accesses the affected page, the browser will execute the malicious JavaScript within the context of that user’s session, enabling credential theft, session hijacking, or other client‑side attacks. The weakness is an unvalidated input that is rendered directly into the page, which matches the classic XSS vulnerability profile.

The affected system is GmbH Mecury Managed Print Services (docuForm) version 11.11c. No other vendors or products were enumerated. The vulnerability resides in the menu_orderopt.php component of this product.

The vulnerability is a reflected XSS that requires an attacker to persuade or trick a user into visiting a crafted URL or form submission. The CVSS score is 7.3, indicating high severity, while the EPSS score is not available. Based on this score, the risk is considered significant. The CVE is not listed in CISA KEV, indicating no reported active exploitation at the time of this analysis. Attacking requires user interaction; however, once the payload is executed, the attacker can perform a range of destructive actions within the user’s session.