{"metadata": {"vulnerability": "cve-2026-108905", "count": 16, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-08-09T00:00:00Z", "date_only": false, "value": "2026-08-09T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "cve-2026-108905", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-11T14:47:11.318Z", "date_only": false, "value": "2026-10-11T14:47:11.318Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-108905", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-11T14:58:06.784Z", "date_only": false, "value": "2026-10-11T14:58:06.784Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-108905", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-11T14:58:06.784Z", "date_only": false, "value": "2026-10-11T14:58:06.784Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "cve-2026-108905", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-11T15:05:04.830Z", "date_only": false, "value": "2026-10-11T15:05:04.830926Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117422889650330915", "record": "CVE-2026-108905", "field": "creation_timestamp", "uuid": "bb71182a-b15f-4947-b3aa-2398af604331", "content": "CVE-2026-108905 pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host Header pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with private_api_key=dev772277 and the default allowed URL to retrieve member emails, IP addresses, phone numbers, and bank account fields.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108905https://github.com/pH7Software/pH7-Social-Dating-CMS/commit/cfe1e0c418946b868db8c399d0cf6b122552efd2https://github.com/pH7Software/pH7-Social-Dating-CMS/blob/v18.5.1/_protected/framework/Api/Tool.class.php#L25-L48https://github.com/pH7Software/pH7-Social-Dating-CMShttps://www.vulncheck.com/advisories/ph7builder-before-18.6.0-hard-coded-api-key-bypass-via-host-header#ph7software #ph7builder#CVE_2026_108905#bot", "url": "https://infosec.exchange/users/cve/statuses/117422889650330915"}, {"timestamp": "2026-10-11T15:16:56Z", "date_only": false, "value": "2026-10-11T15:16:56Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-JFR6-F5QC-QP53", "record": "GHSA-JFR6-F5QC-QP53", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-11T15:16:56.803Z", "date_only": false, "value": "2026-10-11T15:16:56.803", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-108905", "record": "FKIE_CVE-2026-108905", "field": "published"}, {"timestamp": "2026-10-11T15:31:11Z", "date_only": false, "value": "2026-10-11T15:31:11Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-JFR6-F5QC-QP53", "record": "GHSA-JFR6-F5QC-QP53", "field": "published"}, {"timestamp": "2026-10-11T15:31:11Z", "date_only": false, "value": "2026-10-11T15:31:11Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-JFR6-F5QC-QP53", "record": "GHSA-JFR6-F5QC-QP53", "field": "modified"}, {"timestamp": "2026-10-11T17:03:10.491Z", "date_only": false, "value": "2026-10-11T17:03:10.491511Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/fi4zkm7geesbp", "record": "CVE-2026-108905", "field": "creation_timestamp", "uuid": "bb40b33f-08a5-4b48-a1b5-e9efd1ed7f12", "content": "CVE-2026-108905 - pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host Header\nCVE ID : CVE-2026-108905\n \n Published : Oct. 11, 2026, 3:16 p.m. | 1\u00a0hour, 8\u00a0minutes ago\n \n Description : pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnera...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/fi4zkm7geesbp"}, {"timestamp": "2026-10-11T19:16:13.691Z", "date_only": false, "value": "2026-10-11T19:16:13.691357Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxmpp42rtb23", "record": "CVE-2026-108905", "field": "creation_timestamp", "uuid": "6595f20f-c8a7-48d4-be79-ef4d466783ba", "content": "\ud83d\udfe0 CVE-2026-108905 - High (7.5)\n\npH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in T...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-108905/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxmpp42rtb23"}, {"timestamp": "2026-10-13T19:18:44.843Z", "date_only": false, "value": "2026-10-13T19:18:44.843740Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-108905", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-13T19:18:44.843Z", "date_only": false, "value": "2026-10-13T19:18:44.843740Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-108905", "record": "FKIE_CVE-2026-108905", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-13T19:19:00.257Z", "date_only": false, "value": "2026-10-13T19:19:00.257Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-108905", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-13T19:19:00.257Z", "date_only": false, "value": "2026-10-13T19:19:00.257Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-108905", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-13T20:17:25.113Z", "date_only": false, "value": "2026-10-13T20:17:25.113", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-108905", "record": "FKIE_CVE-2026-108905", "field": "lastModified"}]}