WinPlus vulnerabilities

3 known vulnerabilities in WinPlus from Informatica del Este. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  WinPlus: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2025-41348Nov 18, 2025Informatica del Este

  SQL injection vulnerability in WinPlus v24.11.27 by Informática del Este. This vulnerability allows an attacker recover, create, update an delete databases by sendng a POST request using the parameters 'val1' and 'cont in '/WinplusPortal/ws/sWinplus.svc/json/g

• 9.8 Critical severity

  WinPlus: Unrestricted Upload of File with Dangerous Type

  CVE-2025-41347Nov 18, 2025Informatica del Este

  Unlimited upload vulnerability for dangerous file types in WinPlus v24.11.27 from Informática del Este. This vulnerability allows an attacker to upload a 'webshell' by sending a POST request to '/WinplusPortal/ws/sWinplus.svc/json/uploadfile'.

• 9.8 Critical severity

  WinPlus: Incorrect Authorization

  CVE-2025-41346Nov 18, 2025Informatica del Este

  Faulty authorization control in software WinPlus v24.11.27 by Informática del Este that allows another user to be impersonated simply by knowing their 'numerical ID', meaning that an attacker could compromise another user's account, thereby affecting the confi