CVE-2025-41346
CriticalSummary
WinPlus version v24.11.27 by Informática del Este has faulty authorization control that allows impersonation of another user simply by knowing their 'numerical ID'. An attacker can compromise another user's account, affecting confidentiality, integrity, and availability of data.
Risk Assessment
An attacker can gain unauthorized access to other users' accounts, leading to data security compromise.
Recommendation
It is recommended to immediately update WinPlus to the latest version and implement stronger authorization mechanisms.
Original NVD description (English source)
Faulty authorization control in software WinPlus v24.11.27 by Informática del Este that allows another user to be impersonated simply by knowing their 'numerical ID', meaning that an attacker could compromise another user's account, thereby affecting the confidentiality, integrity, and availability of the data stored in the application.