CVE-2025-41348

Critical

Published: 18/11/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

WinPlus version v24.11.27 by Informática del Este contains a SQL injection vulnerability. It allows an attacker to recover, create, update, and delete databases by sending a POST request using the parameters 'val1' and 'cont' to '/WinplusPortal/ws/sWinplus.svc/json/getacumper_post'.

Risk Assessment

An attacker can gain full control over the database, leading to compromise of confidentiality, integrity, and availability of data.

Recommendation

It is recommended to immediately update WinPlus to the latest version and apply security patches from the vendor.

Original NVD description (English source)

SQL injection vulnerability in WinPlus v24.11.27 by Informática del Este. This vulnerability allows an attacker recover, create, update an delete databases by sendng a POST request using the parameters 'val1' and 'cont in '/WinplusPortal/ws/sWinplus.svc/json/getacumper_post'.