CVE-2026-107638

pH7Builder pH7 Social Dating CMS before 18.5.0 contains an improper restriction of authentication attempts vulnerability that allows attackers to bypass two-factor authentication by guessing TOTP codes without limits. Attackers who know an account password can submit unlimited 6-digit verificatio...

CVE-2026-107638

The pH7Builder (pH7 Social Dating CMS) software versions before 18.5.0 is vulnerable to an improper restriction of authentication attempts (CWE-307). The flaw resides in VerificationCodeFormProcess.php , where the system fails to limit attempts when verifying TOTP codes. An attacker who already p...

CVE-2026-107638 pH7Builder before 18.5.0 2FA Brute Force via VerificationCodeFormProcess.php

pH7Builder pH7 Social Dating CMS before 18.5.0 contains an improper restriction of authentication attempts vulnerability that allows attackers to bypass two-factor authentication by guessing TOTP codes without limits. Attackers who know an account password can submit unlimited 6-digit verificatio...

EUVD-2026-95025

pH7Builder pH7 Social Dating CMS before 18.5.0 contains an improper restriction of authentication attempts vulnerability that allows attackers to bypass two-factor authentication by guessing TOTP codes without limits. Attackers who know an account password can submit unlimited 6-digit verificatio...

PT-2026-107997

pH7Builder pH7 Social Dating CMS before 18.5.0 contains an improper restriction of authentication attempts vulnerability that allows attackers to bypass two-factor authentication by guessing TOTP codes without limits. Attackers who know an account password can submit unlimited 6-digit verificatio...