EUVD-2026-97068

pH7Builder pH7 Social Dating CMS before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with privateapikey=dev772277 and the default allowed URL t...

CVE-2026-108904 pH7Builder before 18.5.0 Sensitive Data Exposure via Member API UserController

pH7Builder pH7 Social Dating CMS before 18.5.0 contains an information disclosure vulnerability that allows API clients to obtain sensitive member data because UserController::users and user return unfiltered database rows. Attackers holding a valid private API key can retrieve bcrypt password...

CVE-2026-108905

Versions of pH7Builder (pH7 Social Dating CMS) prior to 18.6.0 are vulnerable to a hard-coded API key flaw in Tool.class.php . Unauthenticated attackers can bypass API access checks by spoofing the Host header (e.g., Host: localhost) while providing the hard-coded key private_api_key=dev772277. T...

CVE-2026-108904

The pH7Builder (pH7 Social Dating CMS) version before 18.5.0 contains an information disclosure vulnerability. The root cause is that the UserController::users() and user() functions return unfiltered database rows to API clients. An attacker possessing a valid private API key can exploit this to...

CVE-2026-108905 pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host Header

pH7Builder pH7 Social Dating CMS before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with privateapikey=dev772277 and the default allowed URL t...

CVE-2026-108905 pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host Header

pH7Builder pH7 Social Dating CMS before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with privateapikey=dev772277 and the default allowed URL t...

CVE-2026-108905

pH7Builder pH7 Social Dating CMS before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with privateapikey=dev772277 and the default allowed URL t...

CVE-2026-108904 pH7Builder before 18.5.0 Sensitive Data Exposure via Member API UserController

pH7Builder pH7 Social Dating CMS before 18.5.0 contains an information disclosure vulnerability that allows API clients to obtain sensitive member data because UserController::users and user return unfiltered database rows. Attackers holding a valid private API key can retrieve bcrypt password...

CVE-2026-108904 pH7Builder before 18.5.0 Sensitive Data Exposure via Member API UserController

pH7Builder pH7 Social Dating CMS before 18.5.0 contains an information disclosure vulnerability that allows API clients to obtain sensitive member data because UserController::users and user return unfiltered database rows. Attackers holding a valid private API key can retrieve bcrypt password...

CVE-2026-108854

Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user to delete other users' legacy AppKeys by supplying a numeric apiId. Attackers can iterate sequential key IDs against DELETE /v1/appspace/app/key to revoke AppKeys across...

CVE-2026-108856

UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that allows authenticated users to mint AppKeys bound to other users' MCP servers via POST /v1/appspace/app/key. Attackers supplying a victim's MCP server UUID with appType mcpserver can open MCP sessions and invoke the...

CVE-2026-108860

BotSharp versions through 5.2.0 are vulnerable to an authentication bypass due to a hard-coded JWT signing key located in the WebStarter appsettings.json file. This flaw allows unauthenticated remote attackers to forge bearer tokens by using the committed HMAC secret, fixed issuer, and fixed audi...

CVE-2026-108860 BotSharp through 5.2.0 Authentication Bypass via Hard-Coded JWT Signing Key

BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign tokens with the committed HMAC secret and fixed botsharp issuer and audience t...

CVE-2026-108856 UnicomAI Wanwu through 0.6.5 Authorization Bypass via /v1/appspace/app/key AppKey Minting

UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that allows authenticated users to mint AppKeys bound to other users' MCP servers via POST /v1/appspace/app/key. Attackers supplying a victim's MCP server UUID with appType mcpserver can open MCP sessions and invoke the...

CVE-2026-108856

The UnicomAI Wanwu software through version 0.6.5 is vulnerable to an authorization bypass (CWE-639) via the POST /v1/appspace/app/key endpoint. This flaw allows authenticated users to mint AppKeys bound to other users' MCP servers by providing a victim's MCP server UUID and setting the appType t...

CVE-2026-108856

UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that allows authenticated users to mint AppKeys bound to other users' MCP servers via POST /v1/appspace/app/key. Attackers supplying a victim's MCP server UUID with appType mcpserver can open MCP sessions and invoke the...

EUVD-2026-97007

UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that allows authenticated users to mint AppKeys bound to other users' MCP servers via POST /v1/appspace/app/key. Attackers supplying a victim's MCP server UUID with appType mcpserver can open MCP sessions and invoke the...

CVE-2026-108856 UnicomAI Wanwu through 0.6.5 Authorization Bypass via /v1/appspace/app/key AppKey Minting

UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that allows authenticated users to mint AppKeys bound to other users' MCP servers via POST /v1/appspace/app/key. Attackers supplying a victim's MCP server UUID with appType mcpserver can open MCP sessions and invoke the...

CVE-2026-108856 UnicomAI Wanwu through 0.6.5 Authorization Bypass via /v1/appspace/app/key AppKey Minting

UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that allows authenticated users to mint AppKeys bound to other users' MCP servers via POST /v1/appspace/app/key. Attackers supplying a victim's MCP server UUID with appType mcpserver can open MCP sessions and invoke the...

CVE-2026-108854 Wanwu before 0.6.3 IDOR AppKey Deletion via DELETE /v1/appspace/app/key

Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user to delete other users' legacy AppKeys by supplying a numeric apiId. Attackers can iterate sequential key IDs against DELETE /v1/appspace/app/key to revoke AppKeys across...