CVE ID :CVE-2026-108902
Published : Oct. 11, 2026, 3:16 p.m. | 3 hours, 7 minutes ago
Description :pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulnerability in the picture module deletePhoto() action that allows authenticated members to delete arbitrary files. Attackers can supply ../ sequences in the POST picture_link parameter to remove other members’ photos or configuration and cache files, causing content loss and denial of service.
Severity: 8.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more… To Read More Visit Read More