CVE-2025-41347 — Stored Cross-Site Scripting (XSS) in WinPlus by Informática del Este

CVE-2025-41347

Stored Cross-Site Scripting (XSS) in WinPlus by Informática del Este PUBLISHED

Description (CNA)

Unlimited upload vulnerability for dangerous file types in WinPlus v24.11.27 from Informática del Este. This vulnerability allows an attacker to upload a 'webshell' by sending a POST request to '/WinplusPortal/ws/sWinplus.svc/json/uploadfile'.

Affected (CNA)

Vendor / product	Versions
Informatica del Este / WinPlus	affected 24.11.27

CWE

CWE-434

References

https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-winplus-informatica-del-este

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.