PA
Vendor
PaperCut
52
CVEs
10
On KEV
0
New 30D
Products
PM9.8
PaperCut MF/NG
IT Management
33 CVEs5 on KEV0 new
NG9.8
NG/MF
PaperCut
4 CVEs4 on KEV0 new
PN8.8
Papercut NG/MF
PaperCut
10 CVEs1 on KEV0 new
PH5.9
PaperCut Hive
PaperCut
2 CVEs0 on KEV0 new
MP6.5
Mobility Print Server
Papercut
1 CVEs0 on KEV0 new
PM7.5
Papercut MF Konica Minolta
Papercut
1 CVEs0 on KEV0 new
PD7.3
Print Deploy
PaperCut
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-11744 | PH PaperCut Hive PaperCut | 3.8 | Sep 24 | PaperCut Hive Embedded App for Ricoh: Javascript injection |
| CVE-2026-87739 | PN PaperCut NG/MF PaperCut | 6.9 | Sep 24 | PaperCut MF/NG: User permissions are not evaluated on report generation |
| CVE-2026-82077 | PN PaperCut NG/MF PaperCut | 7.3 | Sep 24 | PaperCut NG/MF: Remote Code Execution via Scan2Fax |
| CVE-2026-14780 | PN PaperCut NG/MF PaperCut | 7.5 | Sep 24 | PaperCut NG/MF: Remote Code Execution via Scripting Subsystem |
| CVE-2026-82078 In wildKEV | PM PaperCut MF/NG PaperCut | 9.1 | Aug 28 | PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector |
| CVE-2026-81578 In wildKEV | PM PaperCut MF/NG PaperCut | 9.8 | Aug 28 | PaperCut MF/NG: Authentication Bypass |
| CVE-2026-8794 | PN PaperCut NG/MF PaperCut | 6.9 | Aug 3 | PaperCut NG/MF: User enumeration via timing attack |
| CVE-2026-8793 | PN PaperCut NG/MF PaperCut | 6.9 | Aug 3 | PaperCut NG/MF: Insufficient brute-force protection |
| CVE-2026-6645 | PD Print Deploy PaperCut | 7.3 | Jun 22 | Insecure Search Path Vulnerability in PaperCut Print Deploy Client for Windows |
| CVE-2026-7824 | PH PaperCut Hive PaperCut | 5.9 | May 5 | PaperCut Hive (Ricoh): Plain text password in logs |
| CVE-2026-6418 | PM PaperCut MF/NG PaperCut | 4.9 | May 5 | PaperCut NG/MF: Path Traversal in Shared Account Synchronization |
| CVE-2026-6180 | PM PaperCut MF/NG PaperCut | 8.1 | May 5 | PaperCut MF: Card truncation on HP readers |
| CVE-2026-5115 | PM PaperCut MF/NG PaperCut | 7.5 | Mar 31 | Session hijacking in PaperCut NG/MF embedded application for Konica Minolta devices |
| CVE-2026-4794 | PM PaperCut MF/NG PaperCut | 4.8 | Mar 31 | Multiple cross-site scripting (XSS) vulnerabilities in PaperCut NG/MF |
| CVE-2024-9672 | PM PaperCut MF/NG PaperCut | 5.4 | Dec 10 | A reflected cross-site scripting (XSS) vulnerability exists in PaperCut NG/MF |
| CVE-2023-39470 | PM PaperCut MF/NG PaperCut | 7.2 | Nov 22 | PaperCut NG print.script.sandboxed Exposed Dangerous Function Remote Code Execution Vulnerability |
| CVE-2024-8405 | PM PaperCut MF/NG PaperCut | 5.5 | Sep 26 | An arbitrary file creation vulnerability exists in PaperCut NG/MF that only affects Windows servers with Web Print enabled |
| CVE-2024-8404 | PM PaperCut MF/NG PaperCut | 7.8 | Sep 26 | An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled |
| CVE-2024-4712 | PM PaperCut MF/NG PaperCut | 7.8 | May 14 | An arbitrary file creation vulnerability exists in PaperCut NG/MF that only affects Windows servers with Web Print enabled. This specific flaw exists within the image-handler… |
| CVE-2024-3037 | PM PaperCut MF/NG PaperCut | 7.8 | May 14 | An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled |
| CVE-2023-39469 | PM PaperCut MF/NG PaperCut | 7.2 | May 3 | PaperCut NG External User Lookup Code Injection Remote Code Execution Vulnerability |
| CVE-2024-1884 | PM PaperCut MF/NG PaperCut | 6.5 | Mar 14 | This is a Server-Side Request Forgery (SSRF) vulnerability in the PaperCut NG/MF server-side module that allows an attacker to induce the server-side application to make HTTP… |
| CVE-2024-1883 | PM PaperCut MF/NG PaperCut | 6.1 | Mar 14 | This is a reflected cross site scripting vulnerability in the PaperCut NG/MF application server |
| CVE-2024-1882 | PM PaperCut MF/NG PaperCut | 7.2 | Mar 14 | This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code execution on the server hosting the PaperCut… |
| CVE-2024-1654 | PM PaperCut MF/NG PaperCut | 7.2 | Mar 14 | This vulnerability potentially allows unauthorized write operations which may lead to remote code execution |
| CVE-2024-1223 | PM PaperCut MF/NG PaperCut | 4.8 | Mar 14 | This vulnerability potentially allows unauthorized enumeration of information from the embedded device APIs |
| CVE-2024-1222 | PM PaperCut MF/NG PaperCut | 9.8 | Mar 14 | This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated privileges |
| CVE-2024-1221 | PM PaperCut MF/NG PaperCut | 3.1 | Mar 14 | This vulnerability potentially allows files on a PaperCut NG/MF server to be exposed using a specifically formed payload against the impacted API endpoint |
| CVE-2023-6006 | PM PaperCut MF/NG PaperCut | 6.7 | Nov 14 | This vulnerability potentially allows local attackers to escalate privileges on affected installations of PaperCut NG |
| CVE-2023-31046 | PM PaperCut MF/NG PaperCut | 6.5 | Oct 19 | A Path Traversal vulnerability exists in PaperCut NG before 22.1.1 and PaperCut MF before 22.1.1 |
| CVE-2023-2508 | MP Mobility Print Server Papercut | 6.5 | Sep 20 | The `PaperCutNG Mobility Print` version 1.0.3512 application allows an unauthenticated attacker to perform a CSRF attack on an instance administrator to configure the clients… |
| CVE-2023-4568 | PM PaperCut MF/NG PaperCut | 6.5 | Sep 13 | PaperCut NG allows for unauthenticated XMLRPC commands to be run by default |
| CVE-2023-39143 | PM PaperCut MF/NG PaperCut | 9.8 | Aug 4 | PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files |
| CVE-2023-3486 | PM PaperCut MF/NG PaperCut | 7.5 | Jul 25 | An authentication bypass exists in PaperCut NG versions 22.0.12 and prior that could allow a remote, unauthenticated attacker to upload arbitrary files to the PaperCut NG host’s… |
| CVE-2023-2533 In wildKEV | PM PaperCut MF/NG PaperCut | 8.8 | Jun 20 | PaperCut MF/NG 22.0.10 (Build 65996 2023-03-27) - Remote code execution via CSRF |
| CVE-2023-27351 RansomwareIn wildKEV | PM PaperCut MF/NG PaperCut | 7.5 | Apr 20 | PaperCut NG/MF Improper Authentication Vulnerability |
| CVE-2023-27350 RansomwareIn wildKEV | PM PaperCut MF/NG PaperCut | 9.8 | Apr 20 | PaperCut MF/NG Improper Access Control Vulnerability |
| CVE-2019-12135 | PM PaperCut MF/NG PaperCut | 9.8 | Jun 6 | An unspecified vulnerability in the application server in PaperCut MF and NG versions 18.3.8 and earlier and versions 19.0.3 and earlier allows remote attackers to execute… |
| CVE-2019-8948 | PM PaperCut MF/NG PaperCut | 9.8 | Feb 20 | PaperCut MF before 18.3.6 and PaperCut NG before 18.3.6 allow script injection via the user interface, aka PC-15163 |
| CVE-2014-2658 | PM PaperCut MF/NG PaperCut | – | Apr 28 | Unspecified vulnerability in Papercut MF and NG before 14.1 (Build 26983) allows attacker to cause a denial of service via unknown vectors |
| CVE-2014-2657 | PM PaperCut MF/NG PaperCut | – | Apr 28 | Unspecified vulnerability in the print release functionality in PaperCut MF before 14.1 (Build 26983) has unknown impact and remote vectors, related to embedded MFPs |
| CVE-2014-2659 | PM PaperCut MF/NG PaperCut | – | Apr 22 | Cross-site request forgery (CSRF) vulnerability in the admin UI in Papercut MF and NG before 14.1 (Build 26983) allows remote attackers to hijack the authentication of… |