Threats tagged 'ghsa-pgc6-pmcp-r3fx'

WinPlus version 24.11.27 contains a critical SQL injection vulnerability that allows attackers to manipulate database operations via a POST request to a specific service endpoint. The flaw enables unauthorized recovery, creation, updating, and deletion of databases by exploiting parameters 'val1' and 'cont' in the '/WinplusPortal/ws/sWinplus.svc/json/getacumper_post' endpoint.