CVE-2026-37604

pH7Builder (pH7 Social Dating CMS) versions through 18.2.0 are vulnerable due to improper validation of the HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers in the _protected/framework/Ip/Ip.class.php file. The application fails to verify if the request originates from a trusted proxy before resol...

EUVD-2026-84812

pH7Software pH7Builder pH7 Social Dating CMS through 18.2.0 resolves the client IP address in protected/framework/Ip/Ip.class.php from the HTTPCLIENTIP and HTTPXFORWARDEDFOR headers without verifying the request comes from a trusted proxy. Because the admin login attempt counter and lockout are...