CVE-2025-14101 IDOR in GG Soft's PaperWork

HighCVSS 7.1 EPSS 0.22%

Published: 2025-12-17 11:11
Updated: 2026-09-28 13:10
Exploit status: No public exploit known

Description

Authorization Bypass Through User-Controlled Key vulnerability in GG Soft Software Services Inc. PaperWork allows Exploitation of Trusted Identifiers.

This issue affects PaperWork: from 5.2.0.9427 before 6.0.

Affected products

Product	Affected versions	Fixed in
GG Soft Software Services Inc. Paperwork	>= 5.2.0.9427, < 6.0	6.0

References

www.usom.gov.tr broken-link government-resource
siberguvenlik.gov.tr government-resource

CVSS v3.1

7.1 High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: Low
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: Low
Availability: None

All scores (2)

v3.1 7.1 · tr-cert
v3.1 7.1 · iletisim@usom.gov.tr

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.22% (percentile 13.2)
CWE: CWE-639 Authorization Bypass Through User-Controlled Key

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.