Informática del Este WinPlus 24.11.27
Approved changes feed: RSS · Atom
cpe:2.3:a:iest:winplus:24.11.27:*:*:*:-:*:*:*part: a version: 24.11.27 update: *
| Vendor | Iest (1925068c-90ed-5e18-8148-c4a9ce439215) |
|---|---|
| Product | Winplus (3ff211b3-5ebd-5900-941e-214b29e24855) |
| Edition | * |
| Language | * |
| Software edition | - |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-41350 |
vulnerable | 2026-06-08 07:25:06.859678 |
Stored Cross-Site Scripting (XSS) in WinPlus by Informática del Este
Stored Cross-site Scripting (XSS)vylnerability type in WinPlus v24.11.27 byInformática del Este that consist of an stored XSS of a stored XSS due to a lack of proper validation of user input by sending a POST request using the 'descripcion' parameter in '/WinplusPortal/ws/sWinplus.svc/json/savesoldoc_post'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details.
Published: 2025-11-18T11:27:42.348Z
Updated: 2026-02-18T12:17:39.735Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-41349 |
vulnerable | 2026-06-08 07:25:06.859218 |
Stored Cross-Site Scripting (XSS) in WinPlus by Informática del Este
Stored Cross-site Scripting (XSS)vylnerability type in WinPlus v24.11.27 byInformática del Este that consist of an stored XSS of a stored XSS due to a lack of proper validation of user input by sending a POST request using the 'descripcion' parameter in '/WinplusPortal/ws/sWinplus. svc/json/savesolpla_post'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details.
Published: 2025-11-18T11:26:23.985Z
Updated: 2026-02-18T12:17:10.086Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-41348 |
vulnerable | 2026-06-08 07:25:06.858740 |
Stored Cross-Site Scripting (XSS) in WinPlus by Informática del Este
SQL injection vulnerability in WinPlus v24.11.27 by Informática del Este. This vulnerability allows an attacker recover, create, update an delete databases by sendng a POST request using the parameters 'val1' and 'cont in '/WinplusPortal/ws/sWinplus.svc/json/getacumper_post'.
Published: 2025-11-18T11:24:06.672Z
Updated: 2026-02-18T12:16:33.695Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-41347 |
vulnerable | 2026-06-08 07:25:06.858124 |
Stored Cross-Site Scripting (XSS) in WinPlus by Informática del Este
Unlimited upload vulnerability for dangerous file types in WinPlus v24.11.27 from Informática del Este. This vulnerability allows an attacker to upload a 'webshell' by sending a POST request to '/WinplusPortal/ws/sWinplus.svc/json/uploadfile'.
Published: 2025-11-18T11:06:39.222Z
Updated: 2026-02-18T12:16:04.094Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-41346 |
vulnerable | 2026-06-08 07:25:06.857272 |
Stored Cross-Site Scripting (XSS) in WinPlus by Informática del Este
Faulty authorization control in software WinPlus v24.11.27 by Informática del Este that allows another user to be impersonated simply by knowing their 'numerical ID', meaning that an attacker could compromise another user's account, thereby affecting the confidentiality, integrity, and availability of the data stored in the application.
Published: 2025-11-18T10:04:11.741Z
Updated: 2026-02-18T12:15:27.836Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.