WinPlus v24.11.27 from Informática del Este contains an unlimited upload vulnerability that allows attackers to upload dangerous file types, including webshells, via a POST request to the '/WinplusPortal/ws/sWinplus.svc/json/uploadfile' endpoint. This vulnerability is identified as CVE-2025-41347 and has a critical CVSS score of 9.8.