CVE-2026-37604: Authentication Bypass by Spoofing

pH7Software pH7Builder pH7 Social Dating CMS through 18.2.0 resolves the client IP address in protected/framework/Ip/Ip.class.php from the HTTPCLIENTIP and HTTPXFORWARDEDFOR headers without verifying the request comes from a trusted proxy. Because the admin login attempt counter and lockout are...

CVE-2026-37604

pH7Software pH7Builder pH7 Social Dating CMS through 18.2.0 resolves the client IP address in protected/framework/Ip/Ip.class.php from the HTTPCLIENTIP and HTTPXFORWARDEDFOR headers without verifying the request comes from a trusted proxy. Because the admin login attempt counter and lockout are...

PT-2026-96935

pH7Software pH7Builder pH7 Social Dating CMS through 18.2.0 resolves the client IP address in protected/framework/Ip/Ip.class.php from the HTTP CLIENT IP and HTTP X FORWARDED FOR headers without verifying the request comes from a trusted proxy. Because the admin login attempt counter and lockout...

CVE-2026-37604

pH7Software pH7Builder pH7 Social Dating CMS through 18.2.0 resolves the client IP address in protected/framework/Ip/Ip.class.php from the HTTPCLIENTIP and HTTPXFORWARDEDFOR headers without verifying the request comes from a trusted proxy. Because the admin login attempt counter and lockout are...

CVE-2026-37604

The pH7Builder (pH7 Social Dating CMS) through version 18.2.0 is vulnerable to an IP-based throttling bypass. The application resolves client IP addresses in _protected/framework/Ip/Ip.class.php using the HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers without verifying if the request originates ...