CVE-2013-7196: static/ajax.php in PHPFox 3.7.3, 3.7.4, and 3.7.5 allows remote authenticated users to bypass intended "Onl...

Security readout for executives and security teams

CVE-2013-7196 is a PHPFox privacy bypass. In PHPFox 3.7.3, 3.7.4, and 3.7.5, an authenticated user could comment on a publication intended to be restricted to “Only Me.” The issue affects confidentiality and integrity of private social content, but the source bundle does not provide CVSS, patch details, or evidence of active exploitation. Exposure is most likely limited to organizations still running PHPFox 3.7.3, 3.7.4, or 3.7.5 with user accounts enabled. Internet-facing community sites, social portals, or legacy PHPFox instances have the clearest risk. The bundle does not identify other affected products or versions. Treat this as a moderate legacy application risk. It is not known to be actively exploited from the provided evidence, but affected PHPFox sites could leak private-user intent and allow unauthorized interaction with private content. Prioritize remediation if the site is internet-facing or user-generated content is business-sensitive. Mitigation focus: Inventory PHPFox deployments and identify any 3.7.3, 3.7.4, or 3.7.5 instances.; Check PHPFox or hosting vendor guidance for fixed versions or official mitigation.; Prioritize upgrading or retiring affected legacy PHPFox installations..

Prepared

Jun 14, 2026, 14:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.