CVE-2026-11744

PaperCut Hive Embedded App for Ricoh: Javascript injection

State: Published
Severity: 3.8 Low
Published: Sep 24, 2026
Updated: Sep 24, 2026
Reserved: Jun 9, 2026

Description

An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices. The application fails to properly sanitize input received during the NFC card reading process before passing it to the application's web view interface. A local attacker with physical access to the device and a specially crafted NFC card or emulator could exploit this flaw to execute arbitrary code within the context of the application's user interface. This could result in unauthorized actions or information disclosure.

Scores

CVSS	Score	Vector	Source
4.0	3.8 Low	CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:U	PaperCut

Weaknesses

CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')

Affected Products

Product	Versions
PaperCut HivePaperCut	2.0.0 to before 2.3.0Affected

References

https://www.papercut.com/kb/Main/security-bulletin-sep-2026/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.