The vulnerability is a reflected Cross‑Site Scripting (CWE‑79) defect in IFTOP that permits authenticated remote attackers to inject arbitrary JavaScript code into victim browsers through specially crafted URLs, leading to client‑side compromise such as credential theft, session hijacking, or page manipulation.

The affected product is WellChoose IFTOP. Versions prior to IFTOP_P4_181 (no explicit sub‑versions listed) are vulnerable. No other versions or products are stated.

The CVSS score is 5.1, reflecting a medium severity issue, and the EPSS score is below 1%, indicating low current exploit likelihood. The vulnerability is not in the CISA KEV catalog. Exploitation requires an attacker to craft a malicious link and persuade or trick an authenticated user to visit it, making it an attacker‑initiated, client‑side attack.