CVE Explorer

CVE-2026-4794

Multiple cross-site scripting (XSS) vulnerabilities in PaperCut NG/MF before 25.0.10 allow authenticated administrator users to inject arbitrary web script or HTML code via different UI fields. This could be used to compromise other admininistrator's sessions or perform unauthorized actions via the administrator's authenticated context (e.g. requires an active login session).

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:3ede5fa2b897805024c09ce607ff07ba8b04ea5f7e2781d0a8e091aece639ad8

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"defaultStatus":"unaffected","platforms":["Windows","MacOS","Linux"],"product":"PaperCut NG/MF","vendor":"PaperCut","versions":[{"lessThan":"25.0.10","status":"affected","version":"0","versionType":"semver"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:cbea7672f762858e3e99b85b3530fc6141b578b7674eaeccad224eed6e6703d0 · sha256:421c6c40a79b81cd… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":2.1,"baseSeverity":"LOW","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact"…

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:cbea7672f762858e3e99b85b3530fc6141b578b7674eaeccad224eed6e6703d0 · sha256:421c6c40a79b81cd… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion

{"cweId":"CWE-79","description":"CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:cbea7672f762858e3e99b85b3530fc6141b578b7674eaeccad224eed6e6703d0 · sha256:421c6c40a79b81cd… · /containers/cna/problemTypes/0/descriptions/0

Source references

1 source assertion

{"url":"https://www.papercut.com/kb/Main/papercut-ng-mf-security-bulletin-march-2026/"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:cbea7672f762858e3e99b85b3530fc6141b578b7674eaeccad224eed6e6703d0 · sha256:421c6c40a79b81cd… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer