Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-11744

PaperCut Hive Embedded App for Ricoh: Javascript injection

CVSS 4.0 3.8 LOWCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-11744

Published

An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices. The application fails to properly sanitize input received during the NFC card reading process before passing it to the application's web view interface. A local attacker with physical access to the device and a specially crafted NFC card or emulator could exploit this flaw to execute arbitrary code within the context of the application's user interface. This could result in unauthorized actions or information disclosure.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-11744

Published

PaperCut Hive

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "PaperCut",
                    "product": "PaperCut Hive",
                    "modules": [
                        "Embedded App for Ricoh"
                    ],
                    "versions": [
                        {
                            "status": "affected",
                            "version": "2.0.0",
                            "lessThan": "2.3.0",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON