Vendor
ph7software
7 known vulnerabilities.
Products
5 results · Clear filters · Feed
-
Medium 6.5
pH7Builder before 18.5.0 Sensitive Data Exposure via Member API UserController
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an information disclosure vulnerability that allows API clients to obtain sensitive member data because UserController::users() and user() return unfiltered database rows. Attackers holding a valid pri…
-
Medium 5.3
pH7Builder before 19.3.0 CAPTCHA Bypass via Client-Chosen Form ID
pH7Builder (pH7 Social Dating CMS) before 19.3.0 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to skip form validation by supplying a client-chosen form ID to PFBC Form::isValid(). Attackers can load a CAPTCHA-free form like lo…
-
Medium 6.8
pH7Builder before 18.5.0 2FA Brute Force via VerificationCodeFormProcess.php
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper restriction of authentication attempts vulnerability that allows attackers to bypass two-factor authentication by guessing TOTP codes without limits. Attackers who know an account password …
-
Medium 6.5
pH7Builder before 18.5.1 Payment Bypass via Payment Module MainController
pH7Builder (pH7 Social Dating CMS) before 18.5.1 contains a payment validation vulnerability that allows registered low-privileged members to obtain any membership tier by supplying client-controlled plan and amount fields. Attackers can set item_number, cart…
-
Medium 4.3
pH7Builder before 18.5.0 Improper Authorization via Note Module delete() Action
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper authorization vulnerability in the note module delete() action that allows authenticated members to delete other members' note comments and categories. Attackers can submit another member's…