PaperCut NG 未授权XMLRPC命令执行漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://www.ddpoc.com/DVB-2025-8758.html
• https://stack.chaitin.com/vuldb/detail/279ec1c1-a98e-4608-a1b0-deada095e94b
• https://cve.imfht.com/detail/CVE-2023-4568
• https://avd.aliyun.com/detail?id=AVD-2023-4568
• https://www.papercut.com/kb/Main/security-vulnerability-log/
• https://pt-br.tenable.com/security/research/tra-2023-31
• https://vuldb.com/zh/vuln/239697
• https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4568.yaml
• https://github.com/advisories/GHSA-59g7-q3pq-jv2x

Related Vulnerabilities

• PoCCVE-2026-81578: PaperCut NG/MF <=26.0.4 - Unauthenticated ConfigEditor Access via Tapestry Complex-Direct
• PaperCut NG/MF /rpc/api/rest/master/user/createInternalUser;/keepalive 权限绕过漏洞 （CVE-2023-27351）
• PoCektron-blog-xmlrpc-xxe: Ektron CMS Blogs xmlrpc.aspx - XML External Entity Injection
• PoCCVE-2023-27351: PaperCut NG - Authentication Bypass
• PoCCVE-2023-27350: PaperCut - Unauthenticated Remote Code Execution
• PoCCVE-2023-39143: PaperCut < 22.1.3 - Path Traversal
• PoCCVE-2023-43187: NodeBB XML-RPC Request xmlrpc.php - XML Injection
• PoCCVE-2023-4568: PaperCut NG Unauthenticated XMLRPC Functionality
• PoCCNVD-2022-43245: Weaver OA XmlRpcServlet - Arbitary File Read
• PoCapache-ofbiz-CVE-2023-51467-xmlrpc-rce: Apache ofbiz CVE-2023-51467 xmlrpc RCE
• PoCdbappsecurity-mingyu-xmlrpc-sock-adduser: 安恒 明御运维审计与风险控制系统 xmlrpc.sock 任意用户添加漏洞
• PoCmingyu-xmlrpc-sock-adduser: Mingyu Operation xmlrpc.sock - User Addition