Informática del Este WinPlus SQL注入漏洞

Informática del Este WinPlus is a human resource management platform from the Spanish company Informática del Este. An SQL injection vulnerability exists in Informática del Este WinPlus version v24.11.27, which stems from insufficient cleanup and escaping of the parameters val1 and cont, which...

PT-2025-47300

Name of the Vulnerable Software and Affected Versions WinPlus version 24.11.27 Description A stored Cross-site Scripting XSS issue exists in WinPlus version 24.11.27 due to insufficient validation of user-supplied data. This allows a remote attacker to send a malicious query to an authenticated...

Informática del Este WinPlus 跨站脚本漏洞

Informática del Este WinPlus is a human resource management platform from the Spanish company Informática del Este. A cross-site scripting vulnerability exists in Informática del Este WinPlus version v24.11.27, which stems from insufficient validation of inputs to the parameter descripcion and...

PT-2025-47298

Name of the Vulnerable Software and Affected Versions WinPlus version 24.11.27 Description A SQL injection issue exists in WinPlus version 24.11.27. This allows an attacker to recover, create, update, and delete databases. The issue is triggered by sending a POST request to the...

Informática del Este WinPlus 跨站脚本漏洞

Informática del Este WinPlus is a human resource management platform from the Spanish company Informática del Este. A cross-site scripting vulnerability exists in Informática del Este WinPlus version v24.11.27, which stems from insufficient validation of inputs to the parameter descripcion and...

PT-2025-47299

Name of the Vulnerable Software and Affected Versions WinPlus version 24.11.27 Description A stored Cross-site Scripting XSS issue exists in WinPlus version 24.11.27 due to insufficient validation of user-supplied data. This allows a remote attacker to send a malicious query to an authenticated...

CVE-2025-41348: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in WinPlus v24.11.27 by Informática del Este. This vulnerability allows an attacker recover, create, update an delete databases by sendng a POST request using the parameters 'val1' and 'cont in '/WinplusPortal/ws/sWinplus.svc/json/getacumperpost'...

Informática del Este WinPlus 代码问题漏洞

Informática del Este WinPlus is a human resource management platform from the Spanish company Informática del Este. A code issue vulnerability exists in Informática del Este WinPlus version v24.11.27, which stems from an unrestricted upload of a dangerous file type that could lead to an attacker...

Informática del Este WinPlus 安全漏洞

Informática del Este WinPlus is a human resource management platform from the Spanish company Informática del Este. A security vulnerability exists in Informática del Este WinPlus version v24.11.27, which stems from improper authorization controls and could allow an attacker to impersonate anothe...

CVE-2025-41349: Improper Neutralization of Input During Web Page Generation

Stored Cross-site Scripting XSSvylnerability type in WinPlus v24.11.27 byInformática del Este that consist of an stored XSS of a stored XSS due to a lack of proper validation of user input by sending a POST request using the 'descripcion' parameter in '/WinplusPortal/ws/sWinplus...

CVE-2025-41347: Unrestricted Upload of File with Dangerous Type

Unlimited upload vulnerability for dangerous file types in WinPlus v24.11.27 from Informática del Este. This vulnerability allows an attacker to upload a 'webshell' by sending a POST request to '/WinplusPortal/ws/sWinplus.svc/json/uploadfile'...

PT-2025-47296

Name of the Vulnerable Software and Affected Versions WinPlus version 24.11.27 Description An issue exists in WinPlus that allows for the upload of dangerous file types. An attacker can upload a 'webshell' by sending a POST request to the ''/WinplusPortal/ws/sWinplus.svc/json/uploadfile'' endpoin...

CVE-2025-41350: Improper Neutralization of Input During Web Page Generation

Stored Cross-site Scripting XSSvylnerability type in WinPlus v24.11.27 byInformática del Este that consist of an stored XSS of a stored XSS due to a lack of proper validation of user input by sending a POST request using the 'descripcion' parameter in...

PT-2025-47289

Name of the Vulnerable Software and Affected Versions WinPlus version 24.11.27 Description A flaw exists in authorization controls within WinPlus that permits user impersonation. An attacker can compromise a user’s account by knowing their numerical ID, potentially impacting the confidentiality,...

CVE-2025-41346: Incorrect Authorization

Faulty authorization control in software WinPlus v24.11.27 by Informática del Este that allows another user to be impersonated simply by knowing their 'numerical ID', meaning that an attacker could compromise another user's account, thereby affecting the confidentiality, integrity, and availabili...