CVE-2025-48827criticalobserved exploitationCWE-424

CVE-2025-48827: critical vulnerability in vBulletin

Published

Follow this CVE+ Monitor vBulletin

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 10epss 76%
from disclosure to weapon2 days
Published on NVDMay 27
1st PoC+2d
metasploitMay 23
VulnCheckMay 26
vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern, as exploited in the wild in May 2025.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
vBulletin · vBulletin
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — vBulletin

In the same product, most dangerous first.

CVE-2025-48828CRITICALCVE-2025-48828EPSS 57.3%CVE-2026-61511CRITICALvBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.phpEPSS 5.6%