Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: ph7software ph7builder 18.5.0 Clear all filters
TI-2026-70782 CVE-2026-108904 · GHSA-3m9j-mmxr-3x76

Member API in pH7Builder exposes password hashes and TOTP secrets

Priority LOW 31

pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an information disclosure vulnerability that allows API clients to obtain sensitive member data because UserController::users() and user() return unfiltered datab…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00316 Published 2026-10-11 Fixed in 18.5.0 CWE-522
TI-2026-70780 CVE-2026-108902 · GHSA-cmhg-xxg9-x9x9

Path traversal in pH7Builder lets members delete arbitrary files

Priority LOW 32

pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulnerability in the picture module deletePhoto() action that allows authenticated members to delete arbitrary files.

CVSS 4.0HIGH 7.2 Network Low privileges No interaction EPSS 0.00375 Published 2026-10-11 Fixed in 18.5.0 CWE-22