Reflected XSS in docuForm Print Services Management Component

A reflected cross-site scripted (XSS) vulnerability in the dfm-menu_orderopt.php component of GmbH Mecury Managed Print Services (docuForm) v11.11c allows attackers to execute arbitrary Javascript in the context of a user's browser via injecting a crafted payload into an unfiltered variable value.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

This vulnerability is a reflected cross-site scripting (XSS) flaw in the dfm-menu_orderopt.php component of docuForm v11.11c, a Managed Print Services platform by GmbH Mecury. Attackers can inject malicious JavaScript payloads through unfiltered user input, which executes in victims' browsers when they click a crafted link. This impacts organizations relying on docuForm for print job management—a critical backend service—potentially allowing attackers to steal session cookies, perform actions on behalf of users, or deliver malware. With a CVSS score of 7.3, this poses significant risk to enterprise environments where print management systems often have broad network access.

Casky's 301 matched skills leverage Claude's extended reasoning to map attack detection across TA0001 (Reconnaissance) and TA0043 (Reconnaissance: Gather Victim Identity Information). Practitioners using Casky would see detection patterns identifying: (1) input validation gaps in GET/POST parameters passed to dfm-menu_orderopt.php, (2) unencoded output rendering in HTML context, and (3) behavioral signatures of reflected XSS injection attempts with script tags or event handlers. The platform flags these as CWE-79 violations and correlates them with pre-attack reconnaissance behaviors where adversaries probe for injectable parameters—allowing teams to catch both active exploitation attempts and the vulnerability footprint before compromise occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2025-61314.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2025-61314

Casky has 301 skills that investigate the attack patterns behind CVE-2025-61314. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn