critical9.8
CVE-2025-41348
SQL injection vulnerability in WinPlus v24.11.27 by Informática del Este.
Impact
SQL injection vulnerability in WinPlus v24.11.27 by Informática del Este. This vulnerability allows an attacker recover, create, update an delete databases by sendng a POST request using the parameters 'val1' and 'cont in '/WinplusPortal/ws/sWinplus.svc/json/getacumper_post'.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Iest | Winplus | Version 24.11.27 |