CVE-2025-41347

Critical

Published: 18/11/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

WinPlus version v24.11.27 by Informática del Este contains an unlimited upload vulnerability for dangerous file types. It allows an attacker to upload a 'webshell' by sending a POST request to '/WinplusPortal/ws/sWinplus.svc/json/uploadfile'.

Risk Assessment

An attacker can upload a malicious file, potentially leading to remote code execution and full server compromise.

Recommendation

It is recommended to immediately update WinPlus to the latest version and implement file type validation and size restrictions.

Original NVD description (English source)

Unlimited upload vulnerability for dangerous file types in WinPlus v24.11.27 from Informática del Este. This vulnerability allows an attacker to upload a 'webshell' by sending a POST request to '/WinplusPortal/ws/sWinplus.svc/json/uploadfile'.