← CVE Intelligence

CVE-2025-41348

Stored Cross-Site Scripting (XSS) in WinPlus by Informática del Este PUBLISHED

Description (CNA)

SQL injection vulnerability in WinPlus v24.11.27 by Informática del Este. This vulnerability allows an attacker recover, create, update an delete databases by sendng a POST request using the parameters 'val1' and 'cont in '/WinplusPortal/ws/sWinplus.svc/json/getacumper_post'.

Affected (CNA)

Vendor / productVersions
Informatica del Este / WinPlusaffected 24.11.27

CWE

CWE-89

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.