CVE-2025-41348 is a critical SQL injection (CVSS 9.8) in WinPlus v24.11.27 from Informática del Este. Two parameters of a web service POST request reach the database unsafely. I could not confirm a fixed version, so restrict access and ask the vendor.
What's affected
The CVE record names WinPlus v24.11.27. The weak input is the val1 and cont parameters of the service at /WinplusPortal/ws/sWinplus.svc/json/getacumper_post, called with a POST request.
The same release carries CVE-2025-41346, an impersonation flaw, and CVE-2025-41347, an unrestricted upload. All three were published on 18 November 2025.
The reference page in the record was not reachable when I looked, so I could not confirm a fixed build. Check with the vendor.
How to check if you're exposed
Confirm the installed WinPlus build. v24.11.27 is the one named in the record, and earlier builds should be treated as affected until the vendor says otherwise.
Check the web server logs for POST requests to the getacumper_post path. Look for unusually long values, odd quote characters or repeated server errors. A spike of 500 responses from one endpoint is a useful signal.
Check the database logs, if you keep them, for queries that the application would not normally send.
What to do now
- Identify all WinPlus servers and the build on each.
- Restrict network access to the portal and its web service paths.
- Reduce the database account to the least privileges the application needs.
- Take a verified backup and review logs for the affected path.
- Ask the vendor for a patch and apply it as soon as it is available.
Why it matters
CWE-89 is SQL injection. The service takes text from the request and builds a database query from it. When the text is not kept apart from the command, the sender can change the command. The record says the result is the ability to recover, create, update and delete databases.
The CVE is not on the CISA Known Exploited Vulnerabilities list. The fix is parameterized queries, which keep the data and the command separate. Until then, a narrow database account limits what a successful injection can do.
This is the third entry for this release, and the pattern is worth noting. An impersonation flaw, an upload flaw and an injection flaw in the same portal point to missing basic checks on the web service layer, not three unrelated slips. If you are the buyer, ask the vendor how it plans to review the rest of the service paths. If you are the operator, assume that more findings may follow and keep the portal off the open internet.
Quick check
Which parameters are involved?
The record names val1 and cont in a POST request to the getacumper_post service.
Is there a patch?
I could not confirm one. Ask Informática del Este and watch the INCIBE notice.
Sources
Last reviewed: 18 October 2026.
