https://vulnogram.org/ Most recent CVEs assigned by PaperCut Software Pty Ltd (papercut). https://vulnogram.org/seaview/icons/papercut.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-11744 https://vulnogram.org/CVE-2026-11744 An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices. The application fails to properly sanitize input received during the NFC card reading process before passing it to the application's web view interf… Low Thu, 24 Sep 2026 06:51:03 GMT https://vulnogram.org/CVE-2026-87739 https://vulnogram.org/CVE-2026-87739 An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report generation requests without valid credentials, an attacker can generate reports and gain unauthor… Medium Network Exploitable Thu, 24 Sep 2026 06:46:54 GMT https://vulnogram.org/CVE-2026-82077 https://vulnogram.org/CVE-2026-82077 An improper limitation of a pathname to a restricted directory (path traversal) vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows an authenticated administrator to execute arbitrary commands on the underlying host via c… High Thu, 24 Sep 2026 06:43:35 GMT https://vulnogram.org/CVE-2026-14780 https://vulnogram.org/CVE-2026-14780 A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access restrictions within the embedded execution engine. An authenticated user with administrative access to the management i… High Thu, 24 Sep 2026 05:17:40 GMT https://vulnogram.org/CVE-2026-82078 https://vulnogram.org/CVE-2026-82078 An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist… Critical Known Exploited Fri, 28 Aug 2026 11:45:25 GMT https://vulnogram.org/CVE-2026-81578 https://vulnogram.org/CVE-2026-81578 An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the com… High Known Exploited Network Exploitable Fri, 28 Aug 2026 11:39:45 GMT https://vulnogram.org/CVE-2026-8794 https://vulnogram.org/CVE-2026-8794 PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username enumeration by measuring response times during login attempts. The system… Medium Network Exploitable Mon, 03 Aug 2026 07:02:42 GMT https://vulnogram.org/CVE-2026-8793 https://vulnogram.org/CVE-2026-8793 PaperCut NG/MF does not properly restrict excessive authentication attempts within its login component. An unauthenticated remote attacker can exploit this vulnerability to perform unrestricted brute-force or credential-stuffing attacks without trigg… Medium Network Exploitable Mon, 03 Aug 2026 06:58:00 GMT https://vulnogram.org/CVE-2026-6645 https://vulnogram.org/CVE-2026-6645 An insecure process execution vulnerability exists in the pc-printer-updater.exe component of the PaperCut Print Deploy Client for Windows. The application, which typically operates with high-level system privileges, attempts to perform an internal v… High Mon, 22 Jun 2026 03:24:06 GMT https://vulnogram.org/CVE-2026-7824 https://vulnogram.org/CVE-2026-7824 An issue was discovered in the PaperCut Hive Ricoh embedded application. When the "Deep Logging" (diagnostic) mode is enabled, the application inadvertently records administrative credentials in plain text within the log files. An attacker with admin… Medium Tue, 05 May 2026 06:22:48 GMT https://vulnogram.org/CVE-2026-6418 https://vulnogram.org/CVE-2026-6418 An issue was discovered in the Shared Account Synchronization component of PaperCut MF (version 25.0.4). The application allows administrative users to configure a source path for account data synchronization. Due to a lack of proper path validation… Medium Tue, 05 May 2026 06:21:37 GMT https://vulnogram.org/CVE-2026-6180 https://vulnogram.org/CVE-2026-6180 A race condition exists in PaperCut MF when processing badge-swipe data from certain HP multifunction devices. Under specific network conditions involving dropped packets and out-of-order sequence counters, the server may incorrectly process fragment… Medium Tue, 05 May 2026 06:19:44 GMT https://vulnogram.org/CVE-2026-5115 https://vulnogram.org/CVE-2026-5115 The PaperCut NG/MF (specifically, the embedded application for Konica Minolta devices) is vulnerable to session hijacking. The PaperCut NG/MF Embedded application is a software interface that runs directly on the touch screen of a multi-function devi… Low Tue, 31 Mar 2026 00:54:48 GMT https://vulnogram.org/CVE-2026-4794 https://vulnogram.org/CVE-2026-4794 Multiple cross-site scripting (XSS) vulnerabilities in PaperCut NG/MF before 25.0.10 allow authenticated administrator users to inject arbitrary web script or HTML code via different UI fields. This could be used to compromise other admininistrator's… Low Tue, 31 Mar 2026 00:39:56 GMT https://vulnogram.org/CVE-2025-9785 https://vulnogram.org/CVE-2025-9785 PaperCut Print Deploy is an optional component that integrates with PaperCut NG/MF which simplifies printer deployment and management. When the component is deployed to an environment, the customer has an option to configure the system to use a self-… High Wed, 03 Sep 2025 04:14:07 GMT https://vulnogram.org/CVE-2024-9672 https://vulnogram.org/CVE-2024-9672 A reflected cross-site scripting (XSS) vulnerability exists in PaperCut NG/MF. This issue can be used to execute specially created JavaScript payloads in the browser. A user must click on a malicious link for this issue to occur. Medium Network Exploitable Mon, 09 Dec 2024 23:49:55 GMT https://vulnogram.org/CVE-2024-8404 https://vulnogram.org/CVE-2024-8404 An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled. To exploit this vulnerability, an attacker must first obtain local login access to the Windows Server hosting PaperCut N… High Thu, 26 Sep 2024 01:42:49 GMT https://vulnogram.org/CVE-2024-8405 https://vulnogram.org/CVE-2024-8405 An arbitrary file creation vulnerability exists in PaperCut NG/MF that only affects Windows servers with Web Print enabled. This specific flaw exists within the web-print.exe process, which can incorrectly create files that don’t exist when a malicio… Medium Thu, 26 Sep 2024 01:36:26 GMT https://vulnogram.org/CVE-2024-4712 https://vulnogram.org/CVE-2024-4712 An arbitrary file creation vulnerability exists in PaperCut NG/MF that only affects Windows servers with Web Print enabled. This specific flaw exists within the image-handler process, which can incorrectly create files that don’t exist when a malicio… High Tue, 14 May 2024 00:13:47 GMT https://vulnogram.org/CVE-2024-3037 https://vulnogram.org/CVE-2024-3037 An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled. To exploit this vulnerability, an attacker must first obtain local login access to the Windows Server hosting PaperCut N… High Tue, 14 May 2024 00:12:37 GMT https://vulnogram.org/CVE-2024-1884 https://vulnogram.org/CVE-2024-1884 This is a Server-Side Request Forgery (SSRF) vulnerability in the PaperCut NG/MF server-side module that allows an attacker to induce the server-side application to make HTTP requests to an arbitrary domain of the attacker's choosing. Medium Network Exploitable Thu, 14 Mar 2024 03:11:48 GMT https://vulnogram.org/CVE-2024-1883 https://vulnogram.org/CVE-2024-1883 This is a reflected cross site scripting vulnerability in the PaperCut NG/MF application server. An attacker can exploit this weakness by crafting a malicious URL that contains a script. When an unsuspecting user clicks on this malicious link, it cou… Medium Network Exploitable Thu, 14 Mar 2024 03:09:43 GMT https://vulnogram.org/CVE-2024-1882 https://vulnogram.org/CVE-2024-1882 This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code execution on the server hosting the PaperCut NG/MF application server. High Thu, 14 Mar 2024 03:08:17 GMT https://vulnogram.org/CVE-2024-1654 https://vulnogram.org/CVE-2024-1654 This vulnerability potentially allows unauthorized write operations which may lead to remote code execution. An attacker must already have authenticated admin access and knowledge of both an internal system identifier and details of another valid use… High Thu, 14 Mar 2024 03:06:54 GMT https://vulnogram.org/CVE-2024-1223 https://vulnogram.org/CVE-2024-1223 This vulnerability potentially allows unauthorized enumeration of information from the embedded device APIs. An attacker must already have existing knowledge of some combination of valid usernames, device names and an internal system key. For such an… Medium Network Exploitable Thu, 14 Mar 2024 03:04:43 GMT https://vulnogram.org/CVE-2024-1222 https://vulnogram.org/CVE-2024-1222 This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated privileges. This applies to a small subset of PaperCut NG/MF API calls. High Network Exploitable Thu, 14 Mar 2024 03:03:18 GMT https://vulnogram.org/CVE-2024-1221 https://vulnogram.org/CVE-2024-1221 This vulnerability potentially allows files on a PaperCut NG/MF server to be exposed using a specifically formed payload against the impacted API endpoint. The attacker must carry out some reconnaissance to gain knowledge of a system token. This CVE… Low Thu, 14 Mar 2024 03:01:05 GMT https://vulnogram.org/CVE-2023-6006 https://vulnogram.org/CVE-2023-6006 This vulnerability potentially allows local attackers to escalate privileges on affected installations of PaperCut NG. An attacker must have local write access to the C Drive. In addition, Print Archiving must be enabled or the attacker needs to enco… High Tue, 14 Nov 2023 04:04:03 GMT