Login Request a demo
PM
IT Management
PaperCut MF/NG
by PaperCut · last CVE Aug 28, 2026
On CISA KEVExploited in the wildRansomware-linked
33
CVEs
5
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities33In the news8Timeline
Severity mix
Critical 7High 12Medium 10Low 1
Severity
All severities33Critical7High12Medium10Low1
Exploitation
On CISA KEV5Exploited in the wild5
Watch

Add PaperCut MF/NG to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2023-6006
6.7
0%
Nov 14
This vulnerability potentially allows local attackers to escalate privileges on affected installations of PaperCut NG
Affected: before 23.0.1
CVE-2024-1884
6.5
38%
Mar 14
This is a Server-Side Request Forgery (SSRF) vulnerability in the PaperCut NG/MF server-side module that allows an attacker to induce the server-side application to make HTTP…
Affected: before 20.1.10; 21.0.0 before 21.2.14; 22.0.0 before 22.1.5; 23.0.1 before 23.0.7
CVE-2023-31046
6.5
2%
Oct 19
A Path Traversal vulnerability exists in PaperCut NG before 22.1.1 and PaperCut MF before 22.1.1
Affected: before 22.1.1
CVE-2023-4568
6.5
4%
Sep 13
PaperCut NG allows for unauthenticated XMLRPC commands to be run by default
Affected: through 22.0.12
CVE-2024-1883
6.1
61%
Mar 14
This is a reflected cross site scripting vulnerability in the PaperCut NG/MF application server
Affected: before 20.1.10; 21.0.0 before 21.2.14; 22.0.0 before 22.1.5; 23.0.1 before 23.0.7
CVE-2024-8405
5.5
0%
Sep 26
An arbitrary file creation vulnerability exists in PaperCut NG/MF that only affects Windows servers with Web Print enabled
Affected: before 23.0.9
CVE-2024-9672
5.4
0%
Dec 10
A reflected cross-site scripting (XSS) vulnerability exists in PaperCut NG/MF
Affected: before 24.1.1
CVE-2026-6418
4.9
1%
May 5
PaperCut NG/MF: Path Traversal in Shared Account Synchronization
Affected: before 25.0.11
CVE-2026-4794
4.8
0%
Mar 31
Multiple cross-site scripting (XSS) vulnerabilities in PaperCut NG/MF
Affected: before 25.0.10
CVE-2024-1223
4.8
0%
Mar 14
This vulnerability potentially allows unauthorized enumeration of information from the embedded device APIs
Affected: before 20.1.10; 21.0.0 before 21.2.14; 22.0.0 before 22.1.5; 23.0.1 before 23.0.7
Showing 10