CVE-2026-37604

pH7Builder (pH7 Social Dating CMS) versions through 18.2.0 are vulnerable due to improper validation of the HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers in the _protected/framework/Ip/Ip.class.php file. The application fails to verify if the request originates from a trusted proxy before resol...