Papercut Mf vulnerabilities

CVE-2026-6418 [MEDIUM] CWE-36 CVE-2026-6418: An issue was discovered in the Shared Account Synchronization component of PaperCut MF (version 25.0 An issue was discovered in the Shared Account Synchronization component of PaperCut MF (version 25.0.4). The application allows administrative users to configure a source path for account data synchronization. Due to a lack of proper path validation and sanitization, an authenticated user with administrative privileges can specify arbitrary file path

CVE-2014-2657 [HIGH] CVE-2014-2657: Unspecified vulnerability in the print release functionality in PaperCut MF before 14.1 (Build 26983 Unspecified vulnerability in the print release functionality in PaperCut MF before 14.1 (Build 26983) has unknown impact and remote vectors, related to embedded MFPs.

CVE-2014-2659 [MEDIUM] CWE-352 CVE-2014-2659: Cross-site request forgery (CSRF) vulnerability in the admin UI in Papercut MF and NG before 14.1 (B Cross-site request forgery (CSRF) vulnerability in the admin UI in Papercut MF and NG before 14.1 (Build 26983) allows remote attackers to hijack the authentication of administrators via unspecified vectors.

CVE-2024-8405 [MEDIUM] CVE-2024-8405: An arbitrary file creation vulnerability exists in PaperCut NG/MF that only affects Windows servers An arbitrary file creation vulnerability exists in PaperCut NG/MF that only affects Windows servers with Web Print enabled. This specific flaw exists within the web-print.exe process, which can incorrectly create files that don’t exist when a maliciously formed payload is provided. This can be used to flood disk space and result in a Denial of Service (DoS) at

CVE-2024-9672 [MEDIUM] CWE-917 CVE-2024-9672: A reflected cross-site scripting (XSS) vulnerability exists in PaperCut NG/MF. This issue can be use A reflected cross-site scripting (XSS) vulnerability exists in PaperCut NG/MF. This issue can be used to execute specially created JavaScript payloads in the browser. A user must click on a malicious link for this issue to occur.

CVE-2024-1223 [MEDIUM] CWE-488 CVE-2024-1223: This vulnerability potentially allows unauthorized enumeration of information from the embedded devi This vulnerability potentially allows unauthorized enumeration of information from the embedded device APIs. An attacker must already have existing knowledge of some combination of valid usernames, device names and an internal system key. For such an attack to be successful the system must be in a specific runtime state.

CVE-2026-4794 [MEDIUM] CWE-79 CVE-2026-4794: Multiple cross-site scripting (XSS) vulnerabilities in PaperCut NG/MF before 25.0.10 allow authentic Multiple cross-site scripting (XSS) vulnerabilities in PaperCut NG/MF before 25.0.10 allow authenticated administrator users to inject arbitrary web script or HTML code via different UI fields. This could be used to compromise other admininistrator's sessions or perform unauthorized actions via the administrator's authenticated context (e.g. requires a

CVE-2014-2658 [MEDIUM] CVE-2014-2658: Unspecified vulnerability in Papercut MF and NG before 14.1 (Build 26983) allows attacker to cause a Unspecified vulnerability in Papercut MF and NG before 14.1 (Build 26983) allows attacker to cause a denial of service via unknown vectors.

CVE-2024-1221 [LOW] CWE-76 CVE-2024-1221: This vulnerability potentially allows files on a PaperCut NG/MF server to be exposed using a specifi This vulnerability potentially allows files on a PaperCut NG/MF server to be exposed using a specifically formed payload against the impacted API endpoint. The attacker must carry out some reconnaissance to gain knowledge of a system token. This CVE only affects Linux and macOS PaperCut NG/MF servers.