This vulnerability (CVE-2025-10968) affects PaperWork software by GG Soft Software Services Inc., specifically versions starting at 6.1.0.9390 and before 6.1.0.9398. It is caused by improper neutralization of special elements in SQL commands (CWE-89), enabling Blind SQL Injection and SQL Injection attacks via the Hibernate framework. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability with network attack vector, low attack complexity, and requiring low privileges but no user interaction. The vulnerability is publicly disclosed but no patch or official fix is currently available. The software is not a cloud service, so remediation depends on vendor patching or user action.

Successful exploitation of this vulnerability can allow an attacker with low privileges to execute arbitrary SQL commands on the backend database, potentially leading to full data disclosure, data modification, or denial of service. The CVSS score of 8.8 indicates a high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild, but the vulnerability presents a significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently available, users should monitor the vendor's communications for updates. Until a fix is released, consider restricting database access permissions and applying any available workarounds recommended by the vendor. Avoid exposing the affected PaperWork versions to untrusted networks.