Stored Cross-site Scripting Vulnerability in WinPlus by Informática del Este

CVE-2025-41349

What is CVE-2025-41349?

A stored Cross-site Scripting (XSS) vulnerability has been identified in WinPlus v24.11.27 by Informática del Este. This vulnerability arises from inadequate validation of user input, specifically when a POST request containing a malicious payload is sent using the 'descripcion' parameter in the API endpoint '/WinplusPortal/ws/sWinplus.svc/json/savesolpla_post'. If exploited, a remote attacker could craft a query that, when executed by an authenticated user, leads to the theft of their session cookies, thereby compromising user sessions and potentially allowing unauthorized access to the application.

References