Paperwork
Monthly
Authenticated SQL injection in GG Soft Software Services Inc.'s Paperwork (versions through 2026-09-09) lets a logged-in low-privileged user inject arbitrary SQL through network-reachable input, giving high confidentiality impact on stored data (CVSS 3.1 base 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). The PR:L prerequisite means the attacker must already hold a valid Paperwork account before the injection can be triggered, and the low integrity rating indicates limited write capability rather than broad database manipulation. No confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; the flaw was reported by TR-CERT.
Authenticated SQL injection in GG Soft Software Services Inc.'s Paperwork (versions through 2026-09-09) lets a logged-in low-privileged user inject arbitrary SQL through network-reachable input, giving high confidentiality impact on stored data (CVSS 3.1 base 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). The PR:L prerequisite means the attacker must already hold a valid Paperwork account before the injection can be triggered, and the low integrity rating indicates limited write capability rather than broad database manipulation. No confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; the flaw was reported by TR-CERT.