{"vulnerability": "CVE-2026-108905", "sightings": [{"uuid": "bb40b33f-08a5-4b48-a1b5-e9efd1ed7f12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108905", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/fi4zkm7geesbp", "content": "CVE-2026-108905 - pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host Header\nCVE ID : CVE-2026-108905\n \n Published : Oct. 11, 2026, 3:16 p.m. | 1\u00a0hour, 8\u00a0minutes ago\n \n Description : pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnera...", "creation_timestamp": "2026-10-11T17:03:10.491511Z"}, {"uuid": "bb71182a-b15f-4947-b3aa-2398af604331", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108905", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117422889650330915", "content": "CVE-2026-108905 pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host Header pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with private_api_key=dev772277 and the default allowed URL to retrieve member emails, IP addresses, phone numbers, and bank account fields.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108905https://github.com/pH7Software/pH7-Social-Dating-CMS/commit/cfe1e0c418946b868db8c399d0cf6b122552efd2https://github.com/pH7Software/pH7-Social-Dating-CMS/blob/v18.5.1/_protected/framework/Api/Tool.class.php#L25-L48https://github.com/pH7Software/pH7-Social-Dating-CMShttps://www.vulncheck.com/advisories/ph7builder-before-18.6.0-hard-coded-api-key-bypass-via-host-header#ph7software #ph7builder#CVE_2026_108905#bot", "creation_timestamp": "2026-10-11T15:05:04.830926Z"}, {"uuid": "6595f20f-c8a7-48d4-be79-ef4d466783ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108905", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxmpp42rtb23", "content": "\ud83d\udfe0 CVE-2026-108905 - High (7.5)\n\npH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in T...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-108905/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-11T19:16:13.691357Z"}]}