Vulnerabilities

CVSS

9.0 Critical

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Risk score

72.0

Published

2025-05-27

Status

Published

Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting template code in an alternative PHP function invocation syntax, such as the "var_dump"("test") syntax, attackers can bypass security checks and execute arbitrary PHP code, as exploited in the wild in May 2025.

Weaknesses

CWE-424

Coverage 1

vulnerability

Public Exploit Released for Patched vBulletin Pre-Auth Code Execution Flaw

A public exploit for a remote code execution vulnerability in vBulletin has been released, targeting versions 6.2.1 and earlier, and 6.1.6 and earlier. The vulnerability allows unauthenticated code execution, but the exp…

The Hacker News · Jul 27, 2026 High

CVE-2026-61511CVE-2025-48827CVE-2025-48828rcevbulletinremote-code-execution

All articles mentioning it

Advisories and references

• karmainsecurity.com/dont-call-that-protected-method-vbulletin-rce
• kevintel.com/CVE-2025-48828
• blog.kevintel.com/vbulletin-replaceadtemplate-kev/