BaseFortify

Publication date: 2025-11-18

Last updated on: 2025-11-19

Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)

Description

Unlimited upload vulnerability for dangerous file types in WinPlus v24.11.27 from Informática del Este. This vulnerability allows an attacker to upload a 'webshell' by sending a POST request to '/WinplusPortal/ws/sWinplus.svc/json/uploadfile'.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-18

Last Modified

2025-11-19

Generated

2026-07-06

AI Q&A

2025-11-18

EPSS Evaluated

2026-07-04

NVD

CVE-2025-41347

Affected Vendors & Products

Vendor	Product	Version / Range
iest	winplus	24.11.27

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

This vulnerability in WinPlus v24.11.27 allows an attacker to upload dangerous file types without restriction by sending a POST request to a specific upload endpoint. This enables the attacker to upload a 'webshell', which is a malicious script that can be used to execute arbitrary commands on the server.

Impact Analysis

The vulnerability can lead to unauthorized remote code execution on the affected server, potentially allowing attackers to take control of the system, access sensitive data, disrupt services, or use the compromised server as a foothold for further attacks.

Hi! I’m here to help you understand CVE-2025-41347. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70