Skip to content
OpenAdvisories

Vendor

PaperCut

35 known vulnerabilities.

Products

PaperCut NG, PaperCut MF 12 PaperCut NG/MF 10 NG 4 PaperCut NG 2 PaperCut Hive 2 Print Deploy 2 PaperCut MF/NG 2 PaperCut MF 1 PaperCut 0
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.4
    CVE-2026-82078 Exploited Public exploit EPSS 63%

    PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector

    An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approv…

    PaperCut PaperCut MF/NG
    KEV Aug 31, 2026
  • High 8.8
    CVE-2026-81578 Exploited Public exploit EPSS 85%

    PaperCut MF/NG: Authentication Bypass

    An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion o…

    PaperCut PaperCut MF/NG
    KEV Aug 31, 2026
  • Medium 6.9
    CVE-2026-8794 Public exploit

    PaperCut NG/MF: User enumeration via timing attack

    PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username enumeration by measuring response times during login attempts. The system executes …

    PaperCut PaperCut NG/MF
  • Medium 6.9
    CVE-2026-8793 Public exploit

    PaperCut NG/MF: Insufficient brute-force protection

    PaperCut NG/MF does not properly restrict excessive authentication attempts within its login component. An unauthenticated remote attacker can exploit this vulnerability to perform unrestricted brute-force or credential-stuffing attacks without triggering acc…

    PaperCut PaperCut NG/MF
  • Medium 6.5
    CVE-2023-4568 Public exploit

    PaperCut NG Unauthenticated XMLRPC

    PaperCut NG allows for unauthenticated XMLRPC commands to be run by default. Versions 22.0.12 and below are confirmed to be affected, but later versions may also be affected due to lack of a vendor supplied patch.

    PaperCut PaperCut NG
  • Critical 9.8
    CVE-2023-27350 Exploited · Ransomware Public exploit EPSS 100%

    This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Bu…

    PaperCut NG
    KEV Apr 21, 2023