CVE-2025-65416
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
docuFORM Managed Print Service Client 11.11c is vulnerable to arbitrary file upload via pmupdate.php. An attacker could upload malicious files to the server.
Risk Assessment
This could lead to remote code execution or system compromise if the uploaded file is executed.
Recommendation
Restrict access to pmupdate.php and implement file upload validation; contact the vendor for a fix.
Other vulnerabilities in docuFORM Managed Print Service Client
See all- CVE-2025-65418High
docuFORM Managed Print Service Client version 11.11c is vulnerable to a directory traversal attack, allowing attackers to read arbitrary files via crafted URL.
- CVE-2025-65417Medium
docuFORM Managed Print Service Client 11.11c is vulnerable to reflected cross-site scripting via the application's login page.
- CVE-2025-65415Medium
docuFORM Managed Print Service Client 11.11c is vulnerable to a session fixation attack via the application's login page. An attacker can force a session identifier on the victim, which is then authenticated.
Original NVD description (English source)
docuFORM Managed Print Service Client 11.11c is vulnerable to arbitrary file upload via pmupdate.php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS