ph7builder vulnerabilities

2 known vulnerabilities in ph7builder from Ph7software. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  ph7builder: Use of Hard-coded Credentials

  CVE-2026-108905Oct 11, 2026Ph7software

  pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with private_api_ke

• 8.1 High severity

  ph7builder: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-108902Oct 11, 2026Ph7software

  pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulnerability in the picture module deletePhoto() action that allows authenticated members to delete arbitrary files. Attackers can supply ../ sequences in the POST picture_link paramet