Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2025-41347

Stored Cross-Site Scripting (XSS) in WinPlus by Informática del Este

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
INCIBE

Description

Unlimited upload vulnerability for dangerous file types in WinPlus v24.11.27 from Informática del Este. This vulnerability allows an attacker to upload a 'webshell' by sending a POST request to '/WinplusPortal/ws/sWinplus.svc/json/uploadfile'.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Informatica del Este WinPlus

Default version status: unaffected

  • 24.11.27affected

References