VulnSocial

CVE-2026-4794General(papercut / papercut_mf)

LOWCVSS 4.8 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch papercut papercut_mf systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Multiple cross-site scripting (XSS) vulnerabilities in PaperCut NG/MF before 25.0.10 allow authenticated administrator users to inject arbitrary web script or HTML code via different UI fields. This could be used to compromise other admininistrator's sessions or perform unauthorized actions via the administrator's authenticated context (e.g. requires an active login session).

papercut CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • papercut_mf
  • papercut_ng

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • General: 2 classified signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 3 mentions (2026-03-31); latest day: 1
  • 4 total mentions across 2 days

Affected systems

Vendors
papercut
Products
papercut_mfpapercut_ng

Deep dive

Activity timeline4 mentions / 2d
01223Mentions · 2026-03-31: 3Mentions · 2026-04-07: 1Patch / Workaround · 2026-04-07: 1Technical Details · 2026-03-31: 2Technical Details · 2026-04-07: 103-3104-07
Signal classification3 categories
General
250.0%
Disclosure
125.0%
Patch
125.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-03-313
Disclosure1General2
2026-04-071
Patch1
Full discourse4 posts
  • インフォセキュアソリューションズ株式会社@InSecSol0417
    Patch

    🖨️【PaperCutにも脆弱性】 PaperCut NG/MF に、管理画面のXSSや一部Konica Minolta連携でのセッション乗っ取りにつながる脆弱性（CVE-2026-4794、CVE-2026-5115）が公表されています。 利用中の環境は25.0.10以降か確認し、早めの更新を進めましょう。 #企業公式相互フォロー

    Post summary

    PaperCut NG/MF has two CVEs (CVE‑2026‑4794, CVE‑2026‑5115) providing XSS and session hijacking; users are urged to verify they are running 25.0.10+ and apply updates.

    110140170
    536 followersView on X
  • Autumn Good@autumn_good_35
    General

    CVE-2026-4794 CVE-2026-5115 PaperCut NG/MF Security Bulletin (March 2026) | PaperCut https://www.papercut.com/kb/Main/papercut-ng-mf-security-bulletin-march-2026/

    Post summary

    The snippet lists two CVEs and provides a link to a PaperCut security bulletin, but offers no additional details on exploitation, patches, or vulnerability specifics.

    00000275
    6.7K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-4794 Multiple cross-site scripting (XSS) vulnerabilities in PaperCut NG/MF before 25.0.10 allow authenticated administrator users to inject arbitrary web script or HTML code… https://www.cve.org/CVERecord?id=CVE-2026-4794

    Post summary

    The snippet announces that CVE‑2026‑4794 is a cross‑site scripting flaw affecting PaperCut NG/MF before version 25.0.10, allowing authenticated administrators to inject arbitrary web scripts or HTML.

    00000110
    56.9K followersView on X
  • CVEarity@CVEarity
    General

    ⚡ New CVE Alert: CVE-2026-4794 📊 Severity: 2.1 🚨 Risk Level: Low 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-4794 #CVE-2026-4794 #CVE #Low #CyberSecurity #InfoSec https://t.co/B07KVg75qL

    Post summary

    The tweet announces CVE‑2026‑4794 with a low severity score and a reference to the NVD entry, but provides no PoC, exploit, patch, or evidence of active exploitation.

    0000015
    123 followersView on X
CPE platform detail2 entries

2 of 2 entries

PartVendorProductVersionTarget SWTarget HW
Apppapercutpapercut_mf---
Apppapercutpapercut_ng---

Explore more

Back to dashboardpapercut CVEspapercut_mf vulnerabilities