CVE-2026-108903— pH7Builder before 19.3.0 CAPTCHA Bypass via Client-Chosen Form ID
Quick assessment
Affected
ph7software ph7builder
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
pH7Builder（pH7 社交 dating CMS）19.3.0 版本之前存在一个验证码（CAPTCHA）绕过漏洞，该漏洞允许未经身份验证的攻击者通过向 PFBC Form::isValid() 方法提供攻击者自定义的表单 ID，从而跳过表单验证。攻击者可以加载无需验证码的表单（例如登录或搜索表单），然后将其表单 ID 与联系、评论、论坛、邀请或注册等数据一同提交，以实现自动化滥用。
Affected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| ph7software | ph7builder | < 19.3.0 |
affected |
19.3.0 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-108903
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
pH7Builder before 19.3.0 CAPTCHA Bypass via Client-Chosen Form ID
Source: CVE Program / CVE List V5
Vulnerability Description
pH7Builder (pH7 Social Dating CMS) before 19.3.0 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to skip form validation by supplying a client-chosen form ID to PFBC Form::isValid(). Attackers can load a CAPTCHA-free form like login or search, then submit its ID with contact, comment, forum, invite or signup data to automate abuse.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在安全决策中依赖未经信任的输入
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ph7software | ph7builder | 0 ~ 19.3.0 | - |
|
II. Public POCs for CVE-2026-108903
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-108903
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-108903 (1)
Vendor Advisories for CVE-2026-108903 (1)
Other References for CVE-2026-108903 (1)
Same Patch Batch · ph7software · 2026-10-11 · 4 CVEs total
| CVE-2026-108902 | 8.1 HIGH | pH7Builder before 18.5.0 Path Traversal Arbitrary File Deletion via picture_link |
| CVE-2026-108905 | 7.5 HIGH | pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host Header |
| CVE-2026-108904 | 6.5 MEDIUM | pH7Builder before 18.5.0 Sensitive Data Exposure via Member API UserController |
IV. Related Vulnerabilities
Same product: ph7builder
-
CVE-2026-108905
pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host -
CVE-2026-108904
pH7Builder before 18.5.0 Sensitive Data Exposure via Member -
CVE-2026-108902
pH7Builder before 18.5.0 Path Traversal Arbitrary File Delet -
CVE-2026-107637
pH7Builder before 18.5.0 Improper Authorization via Note Mod -
CVE-2026-107638
pH7Builder before 18.5.0 2FA Brute Force via VerificationCod
Same vendor: ph7software
-
CVE-2026-108905
pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host -
CVE-2026-108904
pH7Builder before 18.5.0 Sensitive Data Exposure via Member -
CVE-2026-108902
pH7Builder before 18.5.0 Path Traversal Arbitrary File Delet -
CVE-2026-107637
pH7Builder before 18.5.0 Improper Authorization via Note Mod -
CVE-2026-107638
pH7Builder before 18.5.0 2FA Brute Force via VerificationCod
Same weakness: CWE-807
-
CVE-2026-104658
Reliance on Untrusted Inputs in a Security Decision in hMail -
CVE-2026-103923
KaTeX: Existing prototype pollution can bypass trust restric -
CVE-2026-103267
Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via S -
CVE-2026-102117
Kiteworks Core Remote Code Execution -
CVE-2026-101131
deepseek-ai deepseek-harness dsh index.ts reliance on untrus
V. Comments for CVE-2026-108903
No comments yet