Início / CVEs

Vulnerabilidades exploradas (CISA KEV)

CVEs com exploração confirmada pela CISA (Known Exploited Vulnerabilities), com ação exigida e prazos.

5 resultado(s)

Exportar esta busca: RSS · CSV · STIX

CVE-2026-82078 Crítica · 9.1 KEV Urgente · 72 Exploit público CWE-470 28/08/2026

PaperCut NG/MF Unsafe Reflection Vulnerability

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.

CVE-2026-81578 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-305 28/08/2026

PaperCut NG/MF Missing Authentication for Critical Function Vulnerability

An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.

CVE-2023-2533 Alta · 8.8 KEV Alta · 56 CWE-352 20/06/2023

PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in PaperCut NG/MF, which, under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code. This could be exploited if the target is an admin with a current login session. Exploiting this would typically involve the possibility of deceiving an admin into clicking a specially crafted malicious link, potentially leading to unauthorized changes.

CVE-2023-27350 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-284 20/04/2023

PaperCut MF/NG Improper Access Control Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18987.

CVE-2023-27351 Alta · 7.5 KEV Urgente · 73 Exploit público Ransomware CWE-287 20/04/2023

PaperCut NG/MF Improper Authentication Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from improper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-19226.