CVE-2023-27350

CVE-2023-27350 affects PaperCut MF/NG and allows unauthenticated remote code execution by exploiting improper access control in SetupCompleted, enabling code execution as SYSTEM. Public PoCs and exploits exist (e.g., GitHub and Exploit-DB entries) targeting PaperCut MF/NG 8.0+ and various 22.x bu...

CVE-2024-9672

CVE-2024-9672 describes a reflected XSS in PaperCut NG/MF. The vulnerability arises in the product where a user must click a malicious link, enabling JavaScript payload execution in the victim’s browser. Concrete details available in the connected documents show the affected software (PaperCut NG...

CVE-2023-27351

PaperCut NG 22.0.5 (Build 63914) contains an authentication bypass vulnerability in the SecurityRequestFilter class due to improper implementation of the authentication algorithm. This allows remote attackers to bypass authentication without user interaction. Evidence across multiple sources (ZDI...

CVE-2026-82078

CVE-2026-82078 is an unsafe dynamic class loading vulnerability (CWE-470, CVSS 9.4 Critical) in the database connection utilities of PaperCut NG and PaperCut MF . The application instantiates database driver classes from configurable names without an allowlist, allowing arbitrary Java bytecode to...

CVE-2026-81578

An improper access control vulnerability (CWE-306) in the web management interface of PaperCut MF and PaperCut NG allows unauthenticated remote attackers to trigger administrative backend actions before access validation completes, enabling modification of system configurations. The root cause in...

CVE-2019-12135

CVE-2019-12135 concerns PaperCut MF and NG, affecting the application server in versions 18.3.8 and earlier and 19.0.3 and earlier. The vulnerability is unspecified in nature but enables remote attackers to execute arbitrary code via an unspecified vector. The available documents do not provide d...

CVE-2023-2533

CVE-2023-2533 affects PaperCut NG/MF with a CSRF vulnerability that could allow an attacker to alter security settings or, under certain conditions, execute arbitrary code. Exploitation requires an admin with an active session and typically involves luring the admin to click a crafted link. Nessu...

CVE-2023-39143

CVE-2023-39143 affects PaperCut NG/MF before 22.1.3 on Windows. The vulnerability is a path traversal flaw that allows an unauthenticated actor to read, upload, or delete arbitrary files, which can lead to remote code execution when external device integration is enabled. The issue is documented ...

CVE-2023-3486

CVE-2023-3486: An authentication bypass in PaperCut NG (versions 22.0.12 and earlier) could allow a remote, unauthenticated attacker to upload arbitrary files to the PaperCut NG host’s file storage, potentially exhausting resources and disrupting service. Related Nessus entries also cite PaperCut...

CVE-2023-4568

CVE-2023-4568 – PaperCut NG Unauthenticated XMLRPC : Multiple sources confirm PaperCut NG is vulnerable to unauthenticated XML-RPC commands that can be run by default. Affected versions are 22.0.12 and earlier; newer builds may also be affected due to lack of vendor patching. The underlying issue...

CVE-2024-1223

CVE-2024-1223 concerns PaperCut NG/MF. The vulnerability enables unauthorized enumeration of information via the device’s APIs when an attacker already knows a combination of usernames, device names, and an internal system key, and the system is in a specific runtime state. This is described cons...

CVE-2024-1222

CVE-2024-1222 affects PaperCut NG/MF: a vulnerability in a subset of API calls that allows an attacker to gain elevated API authorization levels via a maliciously formed API request. Connected sources consistently describe an elevation-of-privilege issue within PaperCut NG/MF APIs and note the af...

CVE-2024-1221

CVE-2024-1221 affects PaperCut NG/MF on Linux and macOS. It describes improper access controls on the PaperCut API that can allow an attacker to cause related files on the server to be exposed via a crafted payload to an impacted API endpoint. The attacker is said to require some reconnaissance t...

CVE-2024-8404

CVE-2024-8404 describes an arbitrary file deletion vulnerability in PaperCut NG/MF on Windows servers with Web Print enabled. An attacker must have local login access and be able to run low-privilege code via the web-print-hot-folder to delete targeted files. The issue is tied to a split from CVE...

CVE-2024-1654

PaperCut NG/MF (CVE-2024-1654) enables potential unauthorized write operations that may lead to remote code execution. Exploitation requires authenticated admin access and knowledge of both an internal system identifier and another valid user. CVSS v3.1 base score is 7.2 (HIGH) with NETWORK attac...

CVE-2024-1884

CVE-2024-1884 is a Server-Side Request Forgery in the PaperCut NG/MF server-side module. The vulnerability allows the server to be induced to make HTTP requests to an attacker‑chosen domain. The provided documents reiterate SSRF without detailing affected versions or a patch status; no explicit e...

CVE-2024-1882

CVE-2024-1882 affects PaperCut NG/MF: an authenticated admin can create a malicious payload on the PaperCut NG/MF application server, potentially enabling remote code execution. The consolidated sources describe a server‑side resource injection type vulnerability with high impact (C/H/I/A all hig...

CVE-2023-6006

PaperCut NG is affected by CVE-2023-6006. The flaw resides in the pc-pdl-to-image process, which loads an executable from an unsecured location, enabling local privilege escalation to SYSTEM when an attacker has local write access to the C: drive and Print Archiving is enabled (or the system is m...

CVE-2024-8405

CVE-2024-8405: PaperCut NG/MF on Windows with Web Print enabled is affected by an arbitrary file creation flaw in the web-print.exe process. A malicious payload can cause non-existent files to be created, leading to disk-space exhaustion and DoS. Root cause and impact are described in vendor note...

CVE-2023-39470

CVE-2023-39470 concerns PaperCut NG, where the vulnerability lies in the management of the print.script.sandboxed setting. The exposed dangerous function can let an attacker execute code with SYSTEM privileges after authenticating, resulting in remote code execution. Affected product: PaperCut NG...

CVE-2024-1883

CVE-2024-1883 is a reflected cross-site scripting vulnerability in PaperCut NG/MF application server. The attack is triggered by a malicious URL containing a script, and exploitation requires user interaction (the user clicking the link). Impact is described as potentially affecting confidentiali...

CVE-2014-2658

CVE-2014-2658 affects PaperCut MF & NG prior to version 14.1 (Build 26983). The vulnerability allows an attacker to cause a denial-of-service condition via unknown vectors; impact is increased availability risk (DoS). Affected versions include PaperCut MF & NG 14.1 build 26830 and earlier. Remedi...

CVE-2024-3037

CVE-2024-3037 (and related CVE-2024-8404) describe an arbitrary file deletion vulnerability in PaperCut NG/MF running on Windows with Web Print enabled. An attacker must have local login access and be able to execute low-privilege code on the PaperCut host, exploiting a web-print-hot-folder/Web P...

CVE-2023-39469

The CVE-2023-39469 entry concerns PaperCut NG’s External User Lookup code injection that enables Remote Code Execution. Affected component: External User Lookup in PaperCut NG. Root cause: unsafely handling a user-supplied string that is later used to execute Java code, allowing code execution in...

CVE-2014-2659

CVE-2014-2659 is a CSRF vulnerability in the admin UI of PaperCut MF & NG (affecting versions up to 14.1 build 26983; KLA10291 notes 14.1 build 26830 and earlier). The issue allows remote attackers to hijack administrator sessions via unspecified vectors. No exploit specifics are provided in the ...

CVE-2019-8948

CVE-2019-8948 affects PaperCut MF before 18.3.6 and PaperCut NG before 18.3.6, where script injection is possible via the user interface (PC-15163). The CVSS v3 base score is 9.8 (CRITICAL) with network attack vector, no privileges required, and no user interaction. Remediation available in newer...

CVE-2023-31046

The CVE-2023-31046 issue affects PaperCut NG before 22.1.1 and PaperCut MF before 22.1.1. It is a Path Traversal vulnerability where, under certain conditions, an authenticated attacker could obtain read‑only access to the server filesystem by crafting requests like GET /ui/static/..//.., which r...

CVE-2024-4712

CVE-2024-4712 and CVE-2024-8405 describe an arbitrary file creation issue in PaperCut NG/MF on Windows servers with Web Print enabled, affecting the image-handler/web‑print.exe process. The flaws allow a malicious payload to cause the creation of files that shouldn’t exist, potentially enabling l...

CVE-2026-4794

PaperCut NG/MF prior to version 25.0.10 is affected by multiple XSS vulnerabilities in various UI fields that can be exploited by authenticated administrators to inject scripts or HTML, potentially compromising other admins’ sessions or performing actions within the admin context. A fix is availa...

CVE-2026-6418

PaperCut MF (version 25.0.4) Shared Account Synchronization contains a path traversal in which an authenticated administrator can specify arbitrary local file paths for account data synchronization due to insufficient path validation and sanitization. When the synchronization runs, the system par...

CVE-2026-6180

PaperCut MF/NG suffers a race condition in processing badge-swipe data from certain HP devices, under dropped/out-of-order packet conditions. The issue can cause a truncated badge ID to be registered, and in environments with custom badge-ID post-processing scripts, the truncated value may map to...