CVE-2025-8913
Organization Portal System developed by WellChoose has a Local File Inclusion vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on the server.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.8
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.63%
- CWE
- CWE-98
- Published
- 2025-08-13
- Last modified
- 2026-03-12
Affected products
- WellChoose Organization Portal System
Weakness type
Related vulnerabilities
- CVE-2026-87927 — MaxSite CMS through 109.6 Local File Inclusion via ajax dispatcher
- CVE-2026-15667 — Eventin <= 4.1.22 - Authenticated (Contirbutor+) Local File Inclusion via 'event_layout' Parameter
- CVE-2026-15406 — Eventin <= 4.1.22 - Authenticated (Custom+) Local File Inclusion via 'event_layout' Parameter
- CVE-2026-11613 — Divi Ajax Filter <= 5.1.2 - Unauthenticated Local File Inclusion via 'custom_loop_template' Parameter
- CVE-2026-78566 — The Shuffle theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and...
- CVE-2026-78562 — The Verdure Core plugin for WordPress is vulnerable to Local File Inclusion in all versions up to,...
- CVE-2026-78478 — Måne <= 1.7 - Unauthenticated Local File Inclusion
- CVE-2026-14280 — Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys