Multiple cross‑site scripting (XSS) flaws exist in the management interface of PaperCut NG and PaperCut MF prior to version 25.0.10. These bugs allow an authenticated administrator to inject arbitrary JavaScript or HTML into various input fields, and the injected code runs in the context of other administrator sessions. The attacker can hijack sessions, deface the interface, or perform actions normally restricted to administrative privileges.

Users of PaperCut NG and PaperCut MF who are running any release before 25.0.10 are vulnerable. The flaws appear in UI fields where administrators can enter scripts or markup and affect only users with administrative rights; guest or normal users are not impacted.

The overall risk is low, with a CVSS score of 2.1 and an EPSS below 1%, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, because it requires an active administrator session, attackers who compromise or socially engineer an admin account could gain additional control over the system. No public exploits have been reported, but the attack path is straightforward once an admin account is compromised.