CVE-2025-41347

Critical · 9.8

CVSS

9.8

EPSS

0.4%

Published

Nov 18, 2025

CISA due date

—

The record

Unlimited upload vulnerability for dangerous file types in WinPlus v24.11.27 from Informática del Este. This vulnerability allows an attacker to upload a 'webshell' by sending a POST request to '/WinplusPortal/ws/sWinplus.svc/json/uploadfile'.

Affected packages

Ecosystem	Package	Introduced	Fixed