Is CVE-2025-10968 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-10968 being exploited in the wild.

How severe is CVE-2025-10968?

High severity, with a CVSS score of 8.8, published 7 November 2025.

Which products and versions are affected?

GG Soft Software Services Inc. PaperWork 6.1.0.9390 to 6.1.0.9397.

Is there a fix for CVE-2025-10968?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-10968 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-10968?

Check whether you run GG Soft Software Services Inc. PaperWork at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-10968: GG Soft PaperWork SQL injection in Hibernate

CVE-2025-10968 · Severity: high · CVSS 8.8 · Published 2025-11-07

A SQL injection vulnerability exists in GG Soft PaperWork, a document management and workflow automation platform. An authenticated attacker can exploit this flaw to gain unauthorized access to the underlying database, potentially leading to the theft of sensitive corporate documents or the disruption of business operations. The issue has been addressed in version 6.1.0.9398.

Technologies: GG Soft Software Services Inc. PaperWork. Vendors: GG Soft Software Services Inc..

Quick answers

Is CVE-2025-10968 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-10968 being exploited in the wild.
How severe is CVE-2025-10968?: High severity, with a CVSS score of 8.8, published 7 November 2025.
Which products and versions are affected?: GG Soft Software Services Inc. PaperWork 6.1.0.9390 to 6.1.0.9397.
Is there a fix for CVE-2025-10968?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-10968 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-10968?: Check whether you run GG Soft Software Services Inc. PaperWork at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability (CWE-89/CWE-564) exists in GG Soft PaperWork versions 6.1.0.9390 through 6.1.0.9397. The flaw stems from improper neutralization of special elements used in SQL commands within the Hibernate framework, allowing for both standard and Blind SQL injection. An attacker with low-privileged network access can execute arbitrary SQL queries against the backend database. This can result in full data exfiltration, modification of records, or administrative bypass. The vulnerability is resolved in version 6.1.0.9398.

Affected products

GG Soft Software Services Inc. PaperWork 6.1.0.9390 to 6.1.0.9397

Timeline

2025-11-07: disclosed
2025-11-07: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.