{"id":"CVE-2026-37604","aliases":["EUVD-2026-84812","GHSA-f42g-42x9-p8pf"],"status":"published","title":"pH7Software pH7Builder (pH7 Social Dating CMS) through 18.2.0 resolves the client IP address in...","description":"pH7Software pH7Builder (pH7 Social Dating CMS) through 18.2.0 resolves the client IP address in _protected/framework/Ip/Ip.class.php from the HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers without verifying the request comes from a trusted proxy. Because the admin login attempt counter and lockout are keyed on this value, a remote unauthenticated attacker bypasses IP-based throttling by sending a different X-Forwarded-For value per request","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00452,"percentile":0.39541,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-290","CWE-444"],"published":"2026-09-22T00:00:00Z","modified":"2026-10-28T02:30:56Z","references":[{"url":"https://github.com/pH7Software/pH7-Social-Dating-CMS","tags":["package"]},{"url":"https://ph7builder.com","tags":["web"]},{"url":"https://cybermapgroup.com/en/blog/admin-brute-force-protection-bypass-chain-in-ph7builder","tags":["article"]},{"url":"https://cybermapgroup.com/en/blog/admin-brute-force-protection-bypass-chain-in-ph7builder#112-step-by-step-verification","tags":["exploit","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-37604","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-f42g-42x9-p8pf"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/37xxx/CVE-2026-37604.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-37604","description":"pH7Software pH7Builder (pH7 Social Dating CMS) through 18.2.0 resolves the client IP address in _protected/framework/Ip/Ip.class.php from the HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers without verifying the request comes from a trusted proxy. Because the admin login attempt counter and lockout are keyed on this value, a remote unauthenticated attacker bypasses IP-based throttling by sending a different X-Forwarded-For value per request","status":"published","published":"2026-09-22T00:00:00Z","modified":"2026-10-05T13:30:02.607Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T13:39:16.730222Z"}],"euvd":[{"id":"EUVD-2026-84812","description":"pH7Software pH7Builder (pH7 Social Dating CMS) through 18.2.0 resolves the client IP address in _protected/framework/Ip/Ip.class.php from the HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers without verifying the request comes from a trusted proxy. Because the admin login attempt counter and lockout are keyed on this value, a remote unauthenticated attacker bypasses IP-based throttling by sending a different X-Forwarded-For value per request","status":"published","published":"2026-09-22T00:00:00Z","modified":"2026-10-05T13:30:02Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:40.198021Z"}],"ghsa":[{"id":"GHSA-f42g-42x9-p8pf","title":"pH7Software pH7Builder (pH7 Social Dating CMS) through 18.2.0 resolves the client IP address in...","description":"pH7Software pH7Builder (pH7 Social Dating CMS) through 18.2.0 resolves the client IP address in _protected/framework/Ip/Ip.class.php from the HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers without verifying the request comes from a trusted proxy. Because the admin login attempt counter and lockout are keyed on this value, a remote unauthenticated attacker bypasses IP-based throttling by sending a different X-Forwarded-For value per request","status":"published","published":"2026-09-22T21:31:23Z","modified":"2026-10-05T15:33:18Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-290","CWE-444"],"updated_at":"2026-11-02T15:12:48.068686Z"}],"nvd":[{"id":"CVE-2026-37604","description":"pH7Software pH7Builder (pH7 Social Dating CMS) through 18.2.0 resolves the client IP address in _protected/framework/Ip/Ip.class.php from the HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers without verifying the request comes from a trusted proxy. Because the admin login attempt counter and lockout are keyed on this value, a remote unauthenticated attacker bypasses IP-based throttling by sending a different X-Forwarded-For value per request","status":"published","published":"2026-09-22T19:16:43.493Z","modified":"2026-10-05T14:17:21.073Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:12:50.368368Z"}],"osv":[{"id":"CVE-2026-37604","description":"pH7Software pH7Builder (pH7 Social Dating CMS) through 18.2.0 resolves the client IP address in _protected/framework/Ip/Ip.class.php from the HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers without verifying the request comes from a trusted proxy. Because the admin login attempt counter and lockout are keyed on this value, a remote unauthenticated attacker bypasses IP-based throttling by sending a different X-Forwarded-For value per request","status":"published","published":"2026-09-22T00:00:00Z","modified":"2026-10-28T02:30:56.397707927Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:03.040464Z"}]}}