CyberSecBulletin

Ph7software vulnerabilities

We track 2 vulnerabilities in Ph7software products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 11, 2026.

2vulnerabilities
0critical
2high
0exploited
7.8average CVSS score

Latest Ph7software vulnerabilities

  • 7.5 High severity

    ph7builder: Use of Hard-coded Credentials

    CVE-2026-108905Ph7software

    pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with private_api_ke

  • 8.1 High severity

    ph7builder: Improper Limitation of a Pathname to a Restricted Directory

    CVE-2026-108902Ph7software

    pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulnerability in the picture module deletePhoto() action that allows authenticated members to delete arbitrary files. Attackers can supply ../ sequences in the POST picture_link paramet