CVE-2026-1428

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Single Sign-On Portal System developed by WellChoose has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the server.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Jan 26, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-142806.6The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Local File Inclusion in all versions up toCVE-2026-142819.8The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Privilege ECVE-2026-142829.8The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin for WordPress is vulneraCVE-2026-142874.7The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated request handler and doesCVE-2026-142883.1GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that CVE-2026-142899.0The FacturaONE para WooCommerce con VeriFactu WordPress plugin before 5.37 does not authenticate one of its request handlers, whose only proCVE-2026-14295.4Single Sign-On Portal System developed by WellChoose has a Reflected Cross-site Scripting vulnerability, allowing authenticated remote attacCVE-2026-142906.8The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTMLCVE-2026-142917.5The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authenticCVE-2026-142925.4The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end packageCVE-2026-142938.8The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option from a public requesCVE-2026-142967.5When using the Direct XIP update strategy, the main application image starts other cores (i.e. radio core), based on the currently active sl