Skip to content
OpenAdvisories

Vendor

ph7software

7 known vulnerabilities.

Products

ph7builder 7
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2026-108905

    pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host Header

    pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with private_api_k…

    ph7software ph7builder
  • High 8.1
    CVE-2026-108902

    pH7Builder before 18.5.0 Path Traversal Arbitrary File Deletion via picture_link

    pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulnerability in the picture module deletePhoto() action that allows authenticated members to delete arbitrary files. Attackers can supply ../ sequences in the POST picture_link parame…

    ph7software ph7builder