https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-13T17:50:12.412015+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-108905 CVE-2026-108905 — pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host Header 2026-10-13T17:50:12.414020+00:00

Affected: ph7software ph7builder

pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with private_api_key=dev772277 and the default allowed URL to retrieve member emails, IP addresses, phone numbers, and bank account fields.