CVE-2025-41346
Last modified
CVE-2025-41346 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Faulty authorization control in software WinPlus v24.11.27 by Informática del Este that allows another user to be impersonated simply by knowing their 'numerical ID', meaning that an attacker could compromise another user's account, thereby affecting the confidentiality, integrity, and availability of the data stored in the application.. EPSS estimates a 0.28% chance of exploitation in the next 30 days.
Description
Faulty authorization control in software WinPlus v24.11.27 by Informática del Este that allows another user to be impersonated simply by knowing their 'numerical ID', meaning that an attacker could compromise another user's account, thereby affecting the confidentiality, integrity, and availability of the data stored in the application.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Iest | Winplus | 24.11.27 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-41346?
How severe is CVE-2025-41346?
How do I fix CVE-2025-41346?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-41340A lack of authorisation vulnerability has been detected in C…7.5
- CVE-2025-41341A lack of authorisation vulnerability has been detected in C…7.5
- CVE-2025-41342A lack of authorisation vulnerability has been detected in C…7.5
- CVE-2025-41343A lack of authorisation vulnerability has been detected in C…7.5
- CVE-2025-41344A lack of authorisation vulnerability has been detected in C…7.5
- CVE-2025-41345A lack of authorisation vulnerability has been detected in C…7.5
- CVE-2025-41347Unlimited upload vulnerability for dangerous file types in W…9.8
- CVE-2025-41348SQL injection vulnerability in WinPlus v24.11.27 by Informát…9.8
- CVE-2025-41349Stored Cross-site Scripting (XSS)vylnerability type in WinPl…5.4
- CVE-2025-4135A vulnerability was found in Netgear WG302v2 up to 5.2.9 and…6.3
- CVE-2025-41350Stored Cross-site Scripting (XSS)vylnerability type in WinPl…5.4
- CVE-2025-41351Vulnerability that allows a Padding Oracle Attack to be perf…6
Are you affected by CVE-2025-41346?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST