CVE-2025-61307: Mercury Managed Print Services XSS Flaw

CVE-2025-61307 Overview

CVE-2025-61307 is a reflected cross-site scripting (XSS) vulnerability in the acc-menu_papers.php component of docuForm Mercury Managed Print Services version v11.11c. The flaw stems from an unfiltered variable value that allows attackers to inject crafted JavaScript payloads. When a victim loads the manipulated URL, the payload executes in the context of their browser session. The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser, enabling session theft, credential harvesting, and unauthorized actions within the managed print services interface.

Affected Products

docuForm Mercury Managed Print Services v11.11c
acc-menu_papers.php component
Deployments exposing the affected PHP endpoint to user-controlled input

Discovery Timeline

2026-05-11 - CVE-2025-61307 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2025-61307

Vulnerability Analysis

The vulnerability resides in the acc-menu_papers.php script shipped with docuForm Mercury Managed Print Services. The script accepts request parameters and reflects their values back into the rendered HTML response without applying output encoding or input sanitization. Because the response context is HTML, attacker-supplied <script> tags or event-handler attributes are interpreted by the victim's browser.

Reflected XSS requires user interaction. An attacker crafts a malicious URL containing the payload and delivers it through phishing, chat platforms, or embedded links. When the authenticated user clicks the link, the JavaScript runs with the privileges of that user inside the Mercury web application.

The scope change indicated by the CVSS vector reflects that script execution can affect resources beyond the vulnerable component, including cookies and DOM content from related origins where applicable.

Root Cause

The root cause is missing output encoding on a variable reflected by acc-menu_papers.php. The application writes user-controlled input directly into the HTML response stream. No contextual escaping (HTML entity encoding, JavaScript string escaping, or attribute encoding) is applied before rendering.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker constructs a URL targeting the vulnerable parameter on acc-menu_papers.php with a JavaScript payload. The payload is delivered to a Mercury user, typically a printing operator or administrator. Upon visiting the link, the browser parses the reflected payload and executes the attacker's script. The attacker can then exfiltrate session tokens, perform actions on behalf of the user, or redirect to credential phishing pages. Technical references are available in the ZeroBreach Security Resource and the GitHub Gist Code Snippet.

Detection Methods for CVE-2025-61307

Indicators of Compromise

HTTP requests to acc-menu_papers.php containing URL-encoded <script>, onerror=, onload=, or javascript: substrings in query parameters
Referer headers from external domains pointing into the Mercury web interface
Unexpected outbound browser connections from operator workstations to attacker-controlled domains shortly after visiting a Mercury URL
Session cookies appearing in outbound web traffic logs

Detection Strategies

Inspect web server access logs for requests to acc-menu_papers.php with suspicious URL parameter values, focusing on HTML tag patterns and JavaScript event handlers
Deploy a Web Application Firewall (WAF) rule set that flags reflected XSS payloads against the Mercury application path
Correlate phishing email telemetry with subsequent clicks leading to the Mercury application

Monitoring Recommendations

Forward Mercury web server and reverse proxy logs to a centralized analytics platform for query-based hunting on the affected endpoint
Monitor browser endpoint telemetry for script execution originating from the Mercury origin that triggers DOM modifications or outbound fetch calls to unknown hosts
Track authentication anomalies such as concurrent sessions or session reuse from new IP addresses following Mercury access

How to Mitigate CVE-2025-61307

Immediate Actions Required

Restrict access to the Mercury Managed Print Services web interface to trusted internal networks or VPN users
Contact docuForm through the Docuform Security Information portal to obtain a patched build or vendor guidance
Educate operators and administrators about phishing links that target the print management portal

Patch Information

At the time of publication, no vendor patch identifier is listed in the NVD entry for CVE-2025-61307. Administrators should contact docuForm directly to confirm availability of a fixed release for Mercury Managed Print Services v11.11c.

Workarounds

Deploy a WAF rule that blocks requests to acc-menu_papers.php containing HTML tags or JavaScript event handlers in parameter values
Enforce a strict Content Security Policy (CSP) on the Mercury web application to limit inline script execution
Set the HttpOnly and Secure flags on session cookies to reduce the impact of script-based session theft
Require re-authentication for sensitive administrative actions to limit the value of a hijacked session

bash

# Example WAF rule (ModSecurity) to block reflected XSS patterns on the affected endpoint
SecRule REQUEST_URI "@contains acc-menu_papers.php" \
  "phase:2,deny,status:403,id:1006131,\
   chain,msg:'CVE-2025-61307 XSS attempt blocked'"
  SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "t:none,t:urlDecodeUni"