CVE-2026-107638highCWE-307

CVE-2026-107638: falha de alta gravidade em ph7software ph7builder

pH7Builder before 18.5.0 2FA Brute Force via VerificationCodeFormProcess.php

Publicada em

Seguir esta CVE+ Monitorar ph7builder

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.6epss 0.4%
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper restriction of authentication attempts vulnerability that allows attackers to bypass two-factor authentication by guessing TOTP codes without limits. Attackers who know an account password can submit unlimited 6-digit verification codes to VerificationCodeFormProcess.php to take over member, affiliate, or administrator accounts.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
ph7software · ph7builder
CVEs relacionadas — ph7software ph7builder

No mesmo produto, das mais perigosas para as menos.

CVE-2026-108902HIGHpH7Builder before 18.5.0 Path Traversal Arbitrary File Deletion via picture_linkEPSS 0.4%CVE-2026-108904HIGHpH7Builder before 18.5.0 Sensitive Data Exposure via Member API UserControllerEPSS 0.3%CVE-2026-107636HIGHpH7Builder before 18.5.1 Payment Bypass via Payment Module MainControllerEPSS 0.3%CVE-2026-108905HIGHpH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host HeaderEPSS 0.3%CVE-2026-108903MEDIUMpH7Builder before 19.3.0 CAPTCHA Bypass via Client-Chosen Form IDEPSS 0.3%CVE-2026-107637MEDIUMpH7Builder before 18.5.0 Improper Authorization via Note Module delete() ActionEPSS 0.2%