# CVE-2025-41348: SQL injection vulnerability in WinPlus v24.11.27 by Informática del Este. This vulnerability allows an attacker…

Source: https://junglewise.ai/threats/cve-2025-41348-sql-injection-vulnerability-in-winplus-v24-11-27-by-informatica  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-18  
License: CC BY 4.0 with a link back

CVE-2025-41348 · Severity: critical · CVSS 9.8 · Published 2025-11-18

SQL injection vulnerability in WinPlus v24.11.27 by Informática del Este. This vulnerability allows an attacker recover, create, update an delete databases by sendng a POST request using the parameters 'val1' and 'cont in '/WinplusPortal/ws/sWinplus.svc/json/getacumper_post'.

Technologies: [Iest Winplus](https://junglewise.ai/threats/technologies/winplus). Vendors: [Iest](https://junglewise.ai/threats/vendors/iest).

## Quick answers

**Is CVE-2025-41348 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-41348 being exploited in the wild.

**How severe is CVE-2025-41348?** Critical severity, with a CVSS score of 9.8, published 18 November 2025.

**Which products and versions are affected?** Iest Winplus. The advisory does not name versions.

**Is there a fix for CVE-2025-41348?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-41348?** Check whether you run Iest Winplus. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Iest Winplus

## Related threats

- [Stored Cross-site Scripting (XSS)vylnerability type in WinPlus v24.11.27 byInformática del Este that consist of an…](https://junglewise.ai/threats/cve-2025-41350-stored-cross-site-scripting-xss-vylnerability-type-in-winplus-v24)
- [Stored Cross-site Scripting (XSS)vylnerability type in WinPlus v24.11.27 byInformática del Este that consist of an…](https://junglewise.ai/threats/cve-2025-41349-stored-cross-site-scripting-xss-vylnerability-type-in-winplus-v24)
- [Unlimited upload vulnerability for dangerous file types in WinPlus v24.11.27 from Informática del Este. This…](https://junglewise.ai/threats/cve-2025-41347-unlimited-upload-vulnerability-for-dangerous-file-types-in)
- [Faulty authorization control in software WinPlus v24.11.27 by Informática del Este that allows another user to be…](https://junglewise.ai/threats/cve-2025-41346-faulty-authorization-control-in-software-winplus-v24-11-27-by)