Veille CVE

Recherche « PaperCut NG »

7 CVE

Critique 3 Élevée 2 Moyenne 1 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « PaperCut NG » ✕
  1. CVE-2026-87739 6.9 Moyenne

    PaperCut NG/MF

    An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report generation requests without valid credentials, an attacker can generate reports and gain unauthorized access to sensitive information.

  2. CVE-2026-82077 7.3 Élevée

    PaperCut NG/MF

    An improper limitation of a pathname to a restricted directory (path traversal) vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows an authenticated administrator to execute arbitrary commands on the underlying host via crafted fax provider settings.

  3. CVE-2026-11744 3.8 Faible

    PaperCut Hive

    An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices. The application fails to properly sanitize input received during the NFC card reading process before passing it to the application's web view interface. A local attacker with physical access to the device and a specially crafted NFC card or emulator could exploit this flaw to execute arbitrary code within the context of the application's user interface. This could result in unauthorized actions or information disclosure.

  4. CVE-2026-14780 7.5 Élevée

    PaperCut NG/MF

    A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access restrictions within the embedded execution engine. An authenticated user with administrative access to the management interface can supply a malicious script that escapes the runtime sandbox. A successful execution enables an attacker to run unauthorized operating system commands with administrative privileges on the host operating system.

  5. CVE-2026-82078 9.1 Critique Exploitée

    PaperCut MF/NG · Papercut papercut mf · Papercut papercut ng

    An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.

  6. CVE-2026-81578 9.8 Critique Exploitée

    PaperCut MF/NG · Papercut papercut mf · Papercut papercut ng

    An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.

  7. CVE-2023-27350 9.8 Critique Exploitée Rançongiciel

    PaperCut NG · Papercut papercut mf · Papercut papercut ng

    This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18987.