Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: ph7software ph7builder 18.5.0 Clear all filters
TI-2026-69588 CVE-2026-107638 · GHSA-grjj-qrfp-h6h9

Missing rate limit on 2FA codes in pH7Builder lets attackers take over accounts

Priority LOW 35

pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper restriction of authentication attempts vulnerability that allows attackers to bypass two-factor authentication by guessing TOTP codes without limits.

CVSS 4.0HIGH 7.6 Network Low privileges No interaction EPSS 0.00365 Published 2026-10-08 Fixed in 18.5.0 CWE-307
TI-2026-69587 CVE-2026-107637 · GHSA-ww4w-67c9-6hv8

pH7Builder note module flaw lets members delete others' notes

Priority LOW 24

pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper authorization vulnerability in the note module delete() action that allows authenticated members to delete other members' note comments and categories…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00246 Published 2026-10-08 Fixed in 18.5.0 CWE-639