Reflected XSS in docuForm Managed Print Services Component

A reflected cross-site scripted (XSS) vulnerability in the acc-menu_pricess.php component of GmbH Mecury Managed Print Services (docuForm) v11.11c allows attackers to execute arbitrary Javascript in the context of a user's browser via injecting a crafted payload into an unfiltered variable value.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2025-61312 is a reflected cross-site scripting (XSS) vulnerability in the acc-menu_pricess.php component of GmbH Mercury Managed Print Services (docuForm) v11.11c. The vulnerability allows attackers to inject malicious JavaScript payloads through unfiltered user input, which executes in the victim's browser when they click a crafted link or access a malicious page. This is particularly impactful for organizations relying on docuForm for managed print services, as attackers can steal session cookies, redirect users to phishing sites, or perform unauthorized actions on behalf of authenticated users. The high CVSS score of 7.3 reflects the ease of exploitation and the sensitive nature of print management systems that often handle document workflows and user credentials.

Casky.ai's 301 mapped security skills leverage Claude's extended reasoning to identify attack patterns associated with TA0001 (Initial Access) and TA0043 (Reconnaissance) techniques underlying this XSS vulnerability. Practitioners using Casky would observe findings that correlate suspicious parameter injection attempts in HTTP requests to acc-menu_pricess.php with JavaScript payload signatures and DOM-based attack patterns. The platform's skill mapping enables detection of reconnaissance activities where attackers probe for unfiltered input fields, followed by initial access attempts using crafted payloads containing script tags or event handlers. By analyzing request patterns, response behaviors, and payload characteristics against MITRE ATT&CK frameworks, Casky helps security teams identify and respond to exploitation attempts before malicious scripts execute in user browsers.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2025-61312.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2025-61312

Casky has 301 skills that investigate the attack patterns behind CVE-2025-61312. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn