CVE-2013-7196

CVE-2013-7196 describes an access control bypass vulnerability in PHPFox versions 3.7.3, 3.7.4, and 3.7.5. An authenticated attacker can circumvent "Only Me" privacy settings on publications by manipulating the val[item_id] parameter in a request to static/ajax.php, allowing them to comment on private content. This vulnerability has a CVSS score of 5.5, indicating a medium severity with low attack complexity, requiring authentication, and potentially leading to partial confidentiality and integrity impacts. While not listed on the KEV catalog or Hot List, an exploit is publicly available on ExploitDB, though there is no evidence of active exploitation, Metasploit/Nuclei modules, or significant community discussion.