ph7builder

Every one of the 7 is a mark on the map. Named now: 1 to 7, most at risk first.

1. pH7Builder before 18.5.0 Path Traversal Arbitrary File Deletion via picture_linkCVE-2026-108902ph7software · CVSS 8.1 · 0.4% likely

   CWE-22

2. pH7Builder before 18.5.0 2FA Brute Force via VerificationCodeFormProcess.phpCVE-2026-107638ph7software · CVSS 6.8 · 0.4% likely

   CWE-307

3. pH7Builder before 18.5.0 Sensitive Data Exposure via Member API UserControllerCVE-2026-108904ph7software · CVSS 6.5 · 0.3% likely

   CWE-522

4. pH7Builder before 18.5.1 Payment Bypass via Payment Module MainControllerCVE-2026-107636ph7software · CVSS 6.5 · 0.3% likely

   CWE-472

5. pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host HeaderCVE-2026-108905ph7software · CVSS 7.5 · 0.3% likely

   CWE-798

6. pH7Builder before 19.3.0 CAPTCHA Bypass via Client-Chosen Form IDCVE-2026-108903ph7software · CVSS 5.3 · 0.3% likely

   CWE-807

7. pH7Builder before 18.5.0 Improper Authorization via Note Module delete() ActionCVE-2026-107637ph7software · CVSS 4.3 · 0.2% likely

   CWE-639

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.