ph7software ph7builder

• CVE-2026-108905 High 7.5 pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host Header 0.3%
• CVE-2026-108904 Medium 6.5 pH7Builder before 18.5.0 Sensitive Data Exposure via Member API UserController 0.3%
• CVE-2026-108903 Medium 5.3 pH7Builder before 19.3.0 CAPTCHA Bypass via Client-Chosen Form ID 0.3%
• CVE-2026-108902 High 8.1 pH7Builder before 18.5.0 Path Traversal Arbitrary File Deletion via picture_link 0.4%
• CVE-2026-107638 Medium 6.8 pH7Builder before 18.5.0 2FA Brute Force via VerificationCodeFormProcess.php 0.4%
• CVE-2026-107637 Medium 4.3 pH7Builder before 18.5.0 Improper Authorization via Note Module delete() Action 0.2%
• CVE-2026-107636 Medium 6.5 pH7Builder before 18.5.1 Payment Bypass via Payment Module MainController 0.3%