Scanshare maintains a catalog of the major global vulnerabilities which might affect any Scanshare product. For the benefit of the organizations you are strongly encouranged to have an internal vulnearibility checking policy and keep your internal IT infrastracture always up-to-date.
Click on the title to read the CVE record.
CVE-2026-109618
Description
Scanshare is aware of the recently reported PHP classified as critical and tracked as CVE-2026-109618.
Current products
No current Scanshare products are impacted by the PHP vulnerability because no product makes use of PHP code, neither any Scanshare products is shipped with an embedded PHP installation.
However, since the vulnerability is affecting the PHP server and not the code, any PHP installation for any other reason existing on the server(s) where Scanshare products are installed makes the system vulnerable, no matter of the presence of any Scanshare product.
Scanshare highly suggests to check if you run any PHP installation and update it as soon as possible, moreover keep the software always up-to-date.
Older products
No older products have differences compared to current products.
Releated CVE
CVE-2024-5806
Description
Scanshare is aware of the recently reported in the SFTPServer component of IPWorks SSH (.NET Edition) classified as critical and tracked as CVE-2024-5806.
Current products
No current Scanshare products are impacted by the SFTPServer vulnerability because no product makes use of the IPWorks SSH component.
Scanshare products offer functionalities to connect to external FTP, SFTP and FTPS servers in order to capture and store documents, moreover closed internal FTP server implementations are embedded in optional MFP services to handle scanning delivery functionalities offered with FTP protocols by the target vendors.
However no SFTP servers components affected by the vulnerability are embedded in any product.
Scanshare highly suggests to keep the software always up-to-date.
Older products
No older products have differences compared to current products.
Releated CVE
None
CVE-2022-22965
Description
Scanshare is aware of the recently reported Spring4Shell vulnerability classified as general and tracked as CVE-2022-22965.
Current products
No current Scanshare products are impacted by Sprint4Shell vulnerability because no product makes use of any Java functionalities.
Scanshare highly suggests to keep the software always up-to-date.
Older products
In older versions of Scanshare (< 21.03) an embedded Java VM could be found in the Samsung XOA Web client component.
However no Spring Java components were included neither used which makes also older product versions not affected by the Spring4Shell vulnerability.
Releated CVE
None
CVE-2021-442288
Description
Scanshare is aware of the recently reported Apache Log4j vulnerability classified as critical and tracked as CVE-2021-442288.
Current products
No current Scanshare products are impacted by the Apache Log4j vulnerability because no product makes use of the Log4j library.
Scanshare highly suggests to keep the software always up-to-date.
Older products
In older versions of Scanshare (< 21.03) an older version of Log4j (v1.2.16) could be found in the Samsung XOA Web client component.
According the Apache security bulletin: Log4j 1.x does not have Lookup so the risk is lower. Applications using Log4j 1.x are only vulnerable to this attack when they use JNDI in their configuration. A separate CVE (CVE-2021-4104) has been filed for this vulnerability. To mitigate: Audit your logging configuration to ensure it has no JMSAppender configured. Log4j 1.x configurations without JMSAppender are not impacted by this vulnerability.
Scanshare Samsung XOA Web client makes no use of the JMSAppender hence neither older products are impacted by the Apache Log4j vulnerability.
Since Scanshare v5.21.03 Samsung XOA Web client is no longer included in the product installer.