Threats tagged 'ghsa-jfr6-f5qc-qp53'

pH7Builder versions prior to 18.6.0 contain a hard-coded API key vulnerability in Tool.class.php. This flaw allows unauthenticated attackers to bypass API access controls by spoofing the Host header and using a default private API key. Exploitation can lead to unauthorized retrieval of sensitive member information including emails, IP addresses, phone numbers, and bank account details.