CVE-2025-61311: Mercury docuForm Reflected XSS Vulnerability

CVE-2025-61311 Overview

CVE-2025-61311 is a reflected cross-site scripting (XSS) vulnerability in the dfm-menu_alerts.php component of docuForm Mercury Managed Print Services version 11.11c. The flaw allows attackers to execute arbitrary JavaScript in the context of an authenticated user's browser. Exploitation requires injecting a crafted payload into an unfiltered variable value processed by the vulnerable endpoint. The issue is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact

An attacker who lures an authenticated Mercury Managed Print Services user to a crafted URL can execute JavaScript in the user's session, enabling session theft, credential harvesting, and unauthorized actions against the print management interface.

Affected Products

• docuForm GmbH Mercury Managed Print Services v11.11c
• dfm-menu_alerts.php component
• Deployments exposing the Mercury web interface to untrusted networks

Discovery Timeline

• 2026-05-11 - CVE-2025-61311 published to NVD
• 2026-05-12 - Last updated in NVD database

Technical Details for CVE-2025-61311

Vulnerability Analysis

The vulnerability resides in dfm-menu_alerts.php, a component of the Mercury Managed Print Services web application. The script accepts user-controlled input through a request parameter and reflects that value back into the rendered HTML response without sanitization or output encoding. Because the reflected value is not neutralized, an attacker can supply HTML and JavaScript that the victim's browser parses and executes.

The attack requires user interaction, typically delivered through a crafted link in an email, chat message, or third-party web page. When an authenticated Mercury user follows the link, the malicious payload runs under the application's origin. The attacker inherits the user's session privileges within that browsing context.

Additional technical detail is available in the GitHub Gist published by ZeroBreach and on the ZeroBreach research site.

Root Cause

The root cause is missing input validation and missing output encoding in dfm-menu_alerts.php. A request parameter flows directly into the HTML response without context-aware escaping, allowing <script> tags and event handler attributes to break out of the intended data context.

Attack Vector

The attack vector is network-based and requires low-privilege authentication plus user interaction. An attacker crafts a URL targeting the dfm-menu_alerts.php endpoint with a JavaScript payload appended to the vulnerable parameter. The victim must click the link while authenticated to the docuForm Mercury web interface. The injected script then executes with the user's session context.

Detection Methods for CVE-2025-61311

Indicators of Compromise

• HTTP requests to dfm-menu_alerts.php containing URL-encoded <script>, javascript:, or onerror= tokens in query parameters
• Referer headers pointing to external domains followed by requests to the Mercury web interface
• Unexpected outbound requests from user browsers to attacker-controlled domains after visiting the print management application
• Anomalous session activity such as configuration changes or alert modifications shortly after a user clicks an external link

Detection Strategies

• Inspect web server access logs for requests to dfm-menu_alerts.php containing HTML metacharacters such as <, >, ", or ' in parameter values
• Deploy a web application firewall (WAF) signature that flags reflected XSS payloads targeting the Mercury endpoint
• Correlate browser telemetry with print management server logs to identify users who loaded crafted URLs
• Review email gateway logs for messages containing links to the Mercury host with suspicious query strings

Monitoring Recommendations

• Enable verbose HTTP logging on the Mercury Managed Print Services server, including full query strings and referers
• Forward access logs to a centralized analytics platform for retention and search
• Alert on access patterns where a single user account receives requests with reflected script-like parameters
• Monitor authentication and privilege-changing actions performed within minutes of suspicious GET requests

How to Mitigate CVE-2025-61311

Immediate Actions Required

• Contact docuForm GmbH to obtain a patched build of Mercury Managed Print Services beyond v11.11c
• Restrict access to the Mercury web interface to trusted management networks using firewall or VPN controls
• Instruct administrators not to click external links that point to the Mercury host while authenticated
• Invalidate active sessions and rotate credentials for accounts that may have followed crafted URLs

Patch Information

No vendor patch reference is listed in the NVD entry at the time of publication. Customers should consult the docuForm official website for vendor advisories and request a fixed release of Mercury Managed Print Services that sanitizes input handled by dfm-menu_alerts.php.

Workarounds

• Place the Mercury web interface behind a reverse proxy or WAF that strips HTML metacharacters from query parameters sent to dfm-menu_alerts.php
• Configure a strict Content-Security-Policy response header that blocks inline scripts and restricts script sources
• Set HttpOnly and SameSite=Strict attributes on session cookies to limit the impact of script execution
• Disable or remove the dfm-menu_alerts.php endpoint if it is not required for operations

# Example NGINX reverse proxy hardening for the Mercury interface
location ~* /dfm-menu_alerts\.php {
    if ($args ~* "(<|>|script|javascript:|onerror=|onload=)") {
        return 403;
    }
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Content-Type-Options "nosniff" always;
    proxy_pass http://mercury_backend;
    proxy_cookie_flags ~ HttpOnly Secure SameSite=Strict;
}