TVN ID	TVN-202603005
CVE ID	CVE-2026-3824, CVE-2026-3825, CVE-2026-3826
CVSS	CVE-2026-3824： 6.1 (Medium) CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2026-3825： 6.1 (Medium) CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2026-3826： 9.8 (Critical) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products	IFTOP version before IFTOP_P4_181
Description	CVE-2026-3824(Open redirect)： Authenticated remote attackers can craft a URL that tricks users into visiting malicious website. CVE-2026-3825(Reflected Cross-site Scripting)： Authenticated remote attackers can execute arbitrary JavaScript codes in user's browser through phishing attacks. CVE-2026-3826(Local File Inclusion)： Unauthenticated remote attackers can execute arbitrary code on the server.
Solution	Update to verison IFTOP_P4_181 or later.
Credit	BTtea(CHT Security)
Public Date	2026-03-11