This vulnerability involves multiple XSS issues in PaperCut NG/MF prior to version 25.0.10. Authenticated administrators can inject malicious scripts through different user interface fields, potentially affecting other administrators by hijacking sessions or performing unauthorized actions. The CVSS 4.0 base score is 2.1, indicating low severity, with attack vector network, low attack complexity, and partial privileges required. The vulnerability does not affect confidentiality, integrity, or availability directly but impacts security through session compromise or unauthorized administrative actions.

The impact is limited to authenticated administrator users who can exploit the XSS flaws to inject scripts that may compromise other administrators' sessions or perform unauthorized actions within the administrative interface. There is no indication of exploitation in the wild or broader impact beyond the administrative context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, administrators should monitor PaperCut's advisories for updates. Until a fix is available, restrict administrator access to trusted users and consider additional controls to limit exposure to this vulnerability.