Stored XSS Vulnerability in WinPlus by Informática del Este

CVE-2025-41350

What is CVE-2025-41350?

A stored cross-site scripting vulnerability exists in WinPlus v24.11.27 developed by Informática del Este. This flaw arises from inadequate validation of user input, specifically when sending a POST request using the 'descripcion' parameter in '/WinplusPortal/ws/sWinplus.svc/json/savesoldoc_post'. An attacker could exploit this vulnerability to craft a malicious query targeted at an authenticated user, potentially allowing the attacker to gain unauthorized access to the user's session details through cookie theft.

References