CVE-2026-108902
pH7Builder before 18.5.0 Path Traversal Arbitrary File Deletion via picture_link
CVSS score
7.2
EPSS probability
%0.4
Risk score
0.0
Published
4 d ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
No verified public exploit code was found.
GitHub repositories, NVD exploit references and the Metasploit Framework were scanned. A record of active exploitation does not mean that public exploit code has been published.
Similar Vulnerabilities
7.6
CVE-2026-107638
pH7Builder before 18.5.0 2FA Brute Force via VerificationCodeFormProcess.php
P
Patch verifiedEPSS %0
8.7
CVE-2026-108905
pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host Header
P
Patch verifiedEPSS %0
7.1
CVE-2026-108904
pH7Builder before 18.5.0 Sensitive Data Exposure via Member API UserController
P
Patch verifiedEPSS %0
7.1
CVE-2026-107636
pH7Builder before 18.5.1 Payment Bypass via Payment Module MainController
P
Patch verifiedEPSS %0
6.9
CVE-2026-108903
pH7Builder before 19.3.0 CAPTCHA Bypass via Client-Chosen Form ID
P
Patch verifiedEPSS %0
5.3
CVE-2026-107637
pH7Builder before 18.5.0 Improper Authorization via Note Module delete() Action
P
Patch verifiedEPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-108902"