Read the docs

WellChoose

Records16All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high9CVSS 7.0–8.9

Exploited now

WellChoose records in CISA KEV

No WellChoose vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Records

16 records

TI-2026-03315 CVE-2026-3826 · GHSA-3fg9-xp5j-324m

WellChoose|IFTOP - Local File Inclusion

Priority MEDIUM 49

IFTOP developed by WellChoose has a Local File Inclusion vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on the server.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00603 Published 2026-03-11 Fixed in IFTOP_P4_181 CWE-98
Priority MEDIUM 49

Organization Portal System developed by WellChoose has a Local File Inclusion vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on the server.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00675 Published 2025-08-13 No fix listed CWE-98
Priority MEDIUM 42

Single Sign-On Portal System developed by WellChoose has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the server.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.01376 Published 2026-01-26 Fixed in IFTOP_P4_181 CWE-78
Priority MEDIUM 42

Single Sign-On Portal System developed by WellChoose has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the server.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.01403 Published 2026-01-26 Fixed in IFTOP_P4_181 CWE-78
Priority MEDIUM 42

Administrative Management System from Wellchoose has an OS Command Injection vulnerability, allowing remote attackers with regular privileges to inject and execute arbitrary OS commands.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01096 Published 2024-10-21 No fix listed CWE-78
Priority MEDIUM 41

Administrative Management System from Wellchoose does not properly validate uploaded file types, allowing remote attackers with regular privileges to upload and execute webshells.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.006 Published 2024-10-21 No fix listed CWE-434
Priority LOW 31

Organization Portal System developed by WellChoose has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00414 Published 2025-08-13 No fix listed CWE-89
Priority LOW 30

Organization Portal System developed by WellChoose has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing at…

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.0037 Published 2025-08-13 No fix listed CWE-79
Priority LOW 30

Organization Portal System developed by WellChoose has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing at…

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.0037 Published 2025-08-13 No fix listed CWE-79
Priority LOW 23

IFTOP developed by WellChoose has a Reflected Cross-site Scripting vulnerability, allowing authenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00292 Published 2026-03-11 Fixed in IFTOP_P4_181 CWE-79
TI-2026-03313 CVE-2026-3824 · GHSA-9qp6-7gw6-mqp6

WellChoose|IFTOP - Open redirect

Priority LOW 23

IFTOP developed by WellChoose has an Open redirect vulnerability, allowing authenticated remote attackers to craft a URL that tricks users into visiting malicious website.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00226 Published 2026-03-11 Fixed in IFTOP_P4_181 CWE-601
Priority LOW 22

Single Sign-On Portal System developed by WellChoose has a Reflected Cross-site Scripting vulnerability, allowing authenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing at…

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00243 Published 2026-01-26 Fixed in IFTOP_P4_181 CWE-79
Open these records in search →