Reflected XSS in docuForm Print Services Management Component

A reflected cross-site scripted (XSS) vulnerability in the dfm-menu_markeralerts.php component of GmbH Mecury Managed Print Services (docuForm) v11.11c allows attackers to execute arbitrary Javascript in the context of a user's browser via injecting a crafted payload into an unfiltered variable value.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2025-61313 is a reflected cross-site scripting (XSS) vulnerability in GmbH Mercury's docuForm Managed Print Services platform (version 11.11c), specifically within the dfm-menu_markeralerts.php component. An attacker can inject malicious JavaScript through unfiltered user input, which executes in the victim's browser when they click a crafted link or visit a malicious page. This vulnerability matters because Managed Print Services are critical infrastructure in many organizations—handling document workflows, user authentication, and sensitive print job data. Organizations running docuForm v11.11c are immediately at risk of session hijacking, credential theft, and lateral movement into broader network environments where print services integrate with Active Directory or other identity systems.

Casky's 301 matching skills leverage Claude's extended reasoning to detect this vulnerability pattern across MITRE ATT&CK's Initial Access (TA0001) and Persistence (TA0043) techniques. When practitioners run security assessments, they'll see detection coverage for: (1) malicious payload injection patterns in HTTP request parameters targeting dfm-menu_markeralerts.php, (2) JavaScript execution signatures indicating script context manipulation, and (3) session hijacking indicators that follow successful XSS exploitation. The skills map input validation failures (CWE-79) to ATT&CK techniques showing how reflected XSS serves as an attack vector for phishing campaigns and credential harvesting. Practitioners will receive findings highlighting which parameters lack output encoding, specific payload evasion patterns to monitor for, and the privilege escalation pathways available once JavaScript executes in an admin's browser context.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2025-61313.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2025-61313

Casky has 301 skills that investigate the attack patterns behind CVE-2025-61313. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn