A reflected cross-site scripting vulnerability in the Docuform acc-menu_pricess component poses a risk of unauthorized script execution and session compromise.

This is a reflected cross-site scripting (XSS) vulnerability occurring within the acc-menu_pricess function. The vulnerability requires the attacker to be authenticated (PR:L) and involves user interaction (UI:R) to execute the malicious payload.

Successful exploitation allows an attacker to execute arbitrary scripts within the context of an authenticated user's session. This could lead to the theft of session tokens, unauthorized actions performed on behalf of the user, or the redirection of users to malicious sites, causing potential data loss and reputational damage. While the CVSS score is 7.3, the impact is localized to the user session.

Immediate Action: Contact the vendor (Docuform) or consult the provided documentation at https://www.docuform.de/ to determine if a security patch or configuration update is available.

Proactive Monitoring: Review application access logs for suspicious URL patterns containing script tags or encoded characters indicative of XSS attempts.

Compensating Controls: Implement a Content Security Policy (CSP) and ensure that input validation and output encoding are enforced at the application level to neutralize reflected payloads.

Public Exploit Available: Unknown

Given the potential for session hijacking, administrators should prioritize investigating the specific version of the software in use. Monitor vendor communications for official patch releases and apply updates as soon as they become available to eliminate the underlying injection flaw.