PaperCut MF prior to 18.3.6 and PaperCut NG prior to 18.3.6 allow script injection via the user interface, aka PC-15163.
papercut papercut mf
papercut papercut ng