CVE-2025-10968: SQLi in GG Soft's PaperWork

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-11-07 · updated 2026-10-07
Weakness: CWE-89

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE - 564 - SQL Injection: Hibernate vulnerability in GG Soft Software Services Inc. PaperWork allows Blind SQL Injection, SQL Injection. This issue affects PaperWork: from 6.1.0.9390 before 6.1.0.9398.

Affected products

GG Soft Software Services Inc. PaperWork: from 6.1.0.9390 before 6.1.0.9398 — fixed in 6.1.0.9398

How to fix

Upgrade to a fixed version: GG Soft Software Services Inc. PaperWork 6.1.0.9398. Check the vendor advisory for mitigations.

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0381
https://www.usom.gov.tr/bildirim/tr-25-0381

Get alerted when CVE-2025-10968 or the next vulnerability affects your stack