CVE-2025-41347
BaseFortify
Publication date: 2025-11-18
Last updated on: 2025-11-19
Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| iest | winplus | 24.11.27 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in WinPlus v24.11.27 allows an attacker to upload dangerous file types without restriction by sending a POST request to a specific upload endpoint. This enables the attacker to upload a 'webshell', which is a malicious script that can be used to execute arbitrary commands on the server.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized remote code execution on the affected server, potentially allowing attackers to take control of the system, access sensitive data, disrupt services, or use the compromised server as a foothold for further attacks.