Ph7software Ph7builder vulnerabilities

CVE-2026-108905 High · 7.5 CWE-798 Oct 11, 2026

pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in...

pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with private_api_key=dev772277 and the default allowed URL to retrieve member emails, IP addresses, phone numbers, and bank account fields.

CVE-2026-108904 Medium · 6.5 CWE-522 Oct 11, 2026

pH7Builder before 18.5.0 Sensitive Data Exposure via Member API UserController

pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an information disclosure vulnerability that allows API clients to obtain sensitive member data because UserController::users() and user() return unfiltered database rows. Attackers holding a valid private API key can retrieve bcrypt password hashes, non-expiring hashValidation reset tokens, and TOTP secrets to take over accounts and bypass two-factor authentication.

CVE-2026-108902 High · 8.1 CWE-22 Oct 11, 2026

pH7Builder before 18.5.0 Path Traversal Arbitrary File Deletion via picture_link

pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulnerability in the picture module deletePhoto() action that allows authenticated members to delete arbitrary files. Attackers can supply ../ sequences in the POST picture_link parameter to remove other members' photos or configuration and cache files, causing content loss and denial of service.

CVE-2026-108903 Medium · 5.3 CWE-807 Oct 11, 2026

pH7Builder before 19.3.0 CAPTCHA Bypass via Client-Chosen Form ID

pH7Builder (pH7 Social Dating CMS) before 19.3.0 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to skip form validation by supplying a client-chosen form ID to PFBC Form::isValid(). Attackers can load a CAPTCHA-free form like login or search, then submit its ID with contact, comment, forum, invite or signup data to automate abuse.

CVE-2026-107638 Medium · 6.8 CWE-307 Oct 8, 2026

pH7Builder before 18.5.0 2FA Brute Force via VerificationCodeFormProcess.php

pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper restriction of authentication attempts vulnerability that allows attackers to bypass two-factor authentication by guessing TOTP codes without limits. Attackers who know an account password can submit unlimited 6-digit verification codes to VerificationCodeFormProcess.php to take over member, affiliate, or administrator accounts.

CVE-2026-107637 Medium · 4.3 CWE-639 Oct 8, 2026

pH7Builder before 18.5.0 Improper Authorization via Note Module delete() Action

pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper authorization vulnerability in the note module delete() action that allows authenticated members to delete other members' note comments and categories. Attackers can submit another member's note ID in the POST id parameter to remove all comments and category associations, since those queries lack profile ID checks.

CVE-2026-107636 Medium · 6.5 CWE-472 Oct 8, 2026

pH7Builder before 18.5.1 Payment Bypass via Payment Module MainController

pH7Builder (pH7 Social Dating CMS) before 18.5.1 contains a payment validation vulnerability that allows registered low-privileged members to obtain any membership tier by supplying client-controlled plan and amount fields. Attackers can set item_number, cart_order_id, or the PayPal custom field while paying a token amount, or submit uncompleted PayPal IPN payments, to gain the most expensive membership and its paid features.