CVE-2023-27350-PoC

CVE-2023-27350 This PoC demonstrates how it’s possible to bypass authentication in PaperCut MF/NG versions starting from 8.0 up to, but not including, 20.1.7, 21.2.11, and 22.0.9. It allows interaction with the system without using valid login credentials. Shodan Prompts 1. http.html:"papercut" 2...

CVE-2023-27350

CVE-2023-27350 The tool is designed specifically for Massive Authentication Bypass Papecut MF/NG, which refers to a process of circumventing or bypassing authentication mechanisms on a large scale. Screenshot Requirements Python3.7+ Supported Os Linuxer Wingays Get start with $ git clone...

CVE-2023-27350

CVE-2023-27350 POC for CVE-2023-27350 affecting PaperCut MF/NG Affected Versions 'PaperCut MF or NG version 8.0 or later excluding patched versions on all OS platforms.' Summary This POC uses an authentication bypass vulnerability chained with abuse of builtin scripting functionality to execute...

CVE-2023-27350

CVE-2023-27350 POC for CVE-2023-27350 affecting PaperCut MF/NG Technical Analysis A technical root cause analysis of the vulnerability, indicators of compromise, and internet exposure can be found on our blog: https://www.horizon3.ai/papercut-cve-2023-27350-deep-dive-and-indicators-of-compromise...

CVE-2023-27350

CVE-2023-27350 Exploit POC This is a Proof of Concept POC exploit for CVE-2023-27350, a vulnerability found in PaperCut MF/NG that allows an unauthenticated attacker to execute arbitrary code with SYSTEM privileges. Requirements Before using this exploit, make sure you have installed the followin...

PaperCut-CVE-2026-81578-82078

Professional security research tool for PaperCut NG/MF vulnerability assessment & authorized exploitation ╔══════════════════════════════════════════════════════════════════╗ ║ PAPERCUT SECURITY TOOL – POWER MODE ║ ║ CVE-2026-81578 · CVE-2026-82078 · v3.1.0 ║ ║ ⚡ powered by yora 1928 ⚡ ║...

CVE-2023-27350-POC

CVE-2023-27350-POC Description: This tool is designed to exploit an authentication bypass vulnerability in PaperCut MF/NG versions 8.0 and above, but prior to versions 20.1.7, 21.2.11, or 22.0.9. The vulnerability allows for unauthorized access to the system and can potentially be used for...

CVE-2023-27350-POC

CVE-2023-27350-POC A python script tht searches for vulnerable version of PaperCut MF/NG More information can be found here: https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software Note: This was created for educational use only. Use at your own risk...

PaperCut-Authentication_Bypass_and_RCE

CVE-2023-27350 — PaperCut NG/MF Authentication Bypass & RCE Standalone Python exploit for the critical authentication bypass and remote code execution vulnerability in PaperCut NG/MF. CVSS 9.8. Description CVE-2023-27350 affects PaperCut NG and MF in versions prior to 20.1.7, 21.2.11, and 22.0.9...

PaperCut NG/MF <=26.0.4 - Unauthenticated ConfigEditor Access via Tapestry Complex-Direct

PaperCut NG and PaperCut MF versions 24.x through 26.x contain an authentication bypass vulnerability in the Apache Tapestry-based web interface. By crafting a complex-direct service request that specifies the public Home page as the render target while invoking the privileged ConfigEditor page's...

PaperCut MF < 25.0.12 / 26.x < 26.0.2 RCE (CVE-2026-14780)

The version of PaperCut MF installed on the remote Windows host is prior to 25.0.12, or 26.x prior to 26.0.2. It is, therefore, affected by a vulnerability: - A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access...

PaperCut MF < 25.0.13 / 26.x < 26.0.5 Multiple Vulnerabilities

The version of PaperCut MF installed on the remote Windows host is prior to 25.0.13, or 26.x prior to 26.0.5. It is, therefore, affected by the following vulnerabilities: - An improper limitation of a pathname to a restricted directory path traversal vulnerability in the Scan-to-Fax component of...

PaperCut CVE-2026-82078 SQL Primitive Detect

Detects CVE-2026-82078 in PaperCut NG/MF when chained with CVE-2026-81578: attacker-controlled user-lookup SQL templates and JDBC driver settings can be written via unauthenticated Tapestry ConfigEditor direct-service requests. !/usr/bin/env python3 -- coding: utf-8 -- """Detect PaperCut...

PaperCut NG/MF Pre-Auth RCE (CVE-2026-81578 + CVE-2026-82078)

Chains CVE-2026-81578 Tapestry direct-service auth bypass with CVE-2026-82078 external user-lookup JDBC abuse. On PaperCut 26.x, reconfigures H2 INIT SQL to evaluate Groovy; on 24.x–25.x uses Derby SYSCSEXPORTQUERYLOBSTOEXTFILE to drop a bootstrap class, then restores factory lookup settings...

PaperCut CVE-2026-81578 Auth Bypass Detect

Detects CVE-2026-81578 in PaperCut NG/MF before 24.1.10 / 25.0.13 / 26.0.5. Apache Tapestry direct/1/Home/ConfigEditor requests validate only the render page Home while invoking privileged ConfigEditor listeners without a session. !/usr/bin/env python3 -- coding: utf-8 -- """Detect PaperCut...

CVE-2026-87739

An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report generation requests without valid credentials, an attacker can generate reports and gain unauthorized access to sensitive information...

CVE-2026-82077

An improper limitation of a pathname to a restricted directory path traversal vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows an authenticated administrator to execute arbitrary commands on the underlying host via crafted fax provider settings...

CVE-2026-87739 PaperCut MF/NG: User permissions are not evaluated on report generation

An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report generation requests without valid credentials, an attacker can generate reports and gain unauthorized access to sensitive information...

CVE-2026-87739

An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. Because user permissions are not evaluated during this process, an attacker can submit report generation requests without valid credentials. This flaw allows for the...

EUVD-2026-85812

An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report generation requests without valid credentials, an attacker can generate reports and gain unauthorized access to sensitive information...