CVE-2025-41346 - Stored Cross-Site Scripting (XSS) in WinPlus by Informática del Este

Back Back to CVE browser

CRITICAL

Stored Cross-Site Scripting (XSS) in WinPlus by Informática del Este

Published Nov 18, 2025

9.3

CRITICAL

CVSS 4.0

EPSS 0.32%

Description

Faulty authorization control in software WinPlus v24.11.27 by Informática del Este that allows another user to be impersonated simply by knowing their 'numerical ID', meaning that an attacker could compromise another user's account, thereby affecting the confidentiality, integrity, and availability of the data stored in the application.

Affected products

Vendor Informatica del Este Product WinPlus Default
unaffected
- Version
  24.11.27
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Informatica del Este

WinPlus

unaffected

Version	Status	Constraints
24.11.27	affected	-

Remediation

Vendor solution

The reported vulnerabilities have been fixed in version 25.10.16 and later of WinPLUS Cloud, released on 10/22/2025.

Weaknesses (1)

CWE-863

Incorrect Authorization

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-197986
Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-winplus-informatica-del-este
patchThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-197986		Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-winplus-informatica-del-este		patchThird Party Advisory