The vulnerability is a reflected cross‑site scripting flaw located in the login page of docuFORM Managed Print Service Client 11.11c. An attacker can inject malicious JavaScript that is reflected back into the page when a crafted URL is visited. Without additional defenses, the injected script can run in the context of the user’s browser, potentially allowing an attacker to steal session cookies, deface the interface, or execute further client‑side attacks.

This issue affects instances of the docuFORM Managed Print Service Client with version 11.11c. The product is distributed by docuFORM GmbH and is used in offices and institutions for managing printing tasks.

The flaw requires an attacker to deliver a specially crafted URL to a user who visits the login page, implying that user interaction is a prerequisite. Because the vulnerability is client‑side, it does not directly compromise the server, but the potential impact on confidentiality and integrity can be significant if an attacker gains access to privileged user accounts. The EPSS score is unavailable, and the vulnerability is not listed in CISA's KEV catalog, indicating limited publicly available exploitation data. The CVSS score is 6.1, indicating a medium severity risk. Until a vendor patch is released, the best mitigation is to ensure strict content security policies and input sanitization.