Paperwork EUVD-2026-91631

Exploitation requires an authenticated session: the CVSS vector specifies PR:L, so the attacker must hold at least a valid low-privileged Paperwork account before triggering the injection. The flaw is reachable over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N), affecting Paperwork versions through 2026-09-09. The description does not name the specific vulnerable parameter, endpoint, or configuration, so the exact injectable feature is not identified in the available data; the primary limiting factor is the authentication prerequisite plus the product's narrow deployment base.

This is an authenticated SQL injection flaw (CWE-89) in GG Soft Software Services' Paperwork, scored CVSS 7.1 via vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. The vector indicates network-reachable, low-complexity exploitation requiring low privileges (PR:L), meaning an attacker must first hold a valid, low-level account - a meaningful barrier that reduces exposure to pre-authenticated internet-wide attack. Impact is skewed toward confidentiality (C:H) with only limited integrity impact (I:L) and no availability impact (A:N), consistent with a data-exfiltration-oriented SQLi rather than full database takeover. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active exploitation or weaponization: exploitation status is 'no public exploit identified at time of analysis.' The single reference is a TR-CERT (Turkish national CERT) advisory, which lends credibility to the report but provides no independent exploitation telemetry. Net assessment: a genuine but moderate-priority issue - the authentication requirement and the niche, low-footprint nature of the product substantially limit real-world risk despite the 'High' CVSS band. Prioritize patching for organizations actually running Paperwork, but this is not a broad, internet-scale emergency. Note: EPSS, KEV, and POC signals are all absent/unknown rather than confirmed-negative, so exploitation likelihood cannot be quantified from the available data.

An attacker with a valid low-privileged Paperwork account submits crafted input into an application field or parameter that is passed unsanitized into an SQL query. The injection lets them read sensitive database contents (e.g., other users' records or credentials) beyond their authorization. No public exploit code is available, so exploitation would currently require manual discovery of the injectable parameter.