The single sign‑on portal system by WellChoose is vulnerable to OS command injection. Authenticated remote attackers can inject arbitrary operating‑system commands, leading to execution on the server and compromising confidentiality, integrity, and availability. The weakness is identified as CWE‑78.

All versions of the WellChoose single sign‑on portal system are affected. The vendor recommends upgrading to version IFTOP_P4_181 or later to remediate the vulnerability.

The CVSS score of 8.7 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, but attackers would require authenticated access to the system, which is a likely attack vector based on the description. If exploited, the injected commands would be executed with the privileges of the underlying service, potentially giving full control over the affected server.