Stored Cross-Site Scripting (XSS) in WinPlus by Informática del Este_CVE-2025-41346

{
    "lastseen": "",
    "description": "Faulty authorization control in software WinPlus v24.11.27 by Inform\u00e1tica del Este that allows another user to be impersonated simply by knowing their 'numerical ID', meaning that an attacker could compromise another user's account, thereby affecting the confidentiality, integrity, and availability of the data stored in the application.",
    "published": "2025-11-18T10:04:11.741Z",
    "modified": "2025-11-18T10:04:11.741Z",
    "type": "cve",
    "title": "Stored Cross-Site Scripting (XSS) in WinPlus by Inform\u00e1tica del Este",
    "source": "INCIBE",
    "references": "https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-winplus-informatica-del-este",
    "id": "CVE-2025-41346",
    "bulletinFamily": "",
    "cwe": [
        "CWE-863"
    ],
    "cvelist": null,
    "sourceData": "Inform\u00e1tica del Este WinPlus 24.11.27",
    "sourceHref": "",
    "cvss": {
        "score": 9.3,
        "severity": "CRITICAL",
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "WinPlus",
    "version": "24.11.27",
    "vendor": "Inform\u00e1tica del Este",
    "ai_description": "Stored Cross-Site Scripting (XSS) vulnerability in WinPlus by Inform\u00e1tica del Este due to faulty authorization control, allowing an attacker to impersonate users and compromise data confidentiality, integrity, and availability.",
    "ai_severity": "Critical",
    "ai_vendor": "Inform\u00e1tica del Este",
    "ai_product": "WinPlus",
    "ai_version": "24.11.27",
    "ai_score": 9.3
}