CVE-2025-48827
100Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 10epss 77%
from disclosure to weapon2 days
Published on NVDMay 27
1st PoC+2d
metasploitMay 23
VulnCheckMay 26
exploitation probability
77%top 1% of all CVEs
observed exploitation
yesVulnCheck
7 public exploit(s)
vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern, as exploited in the wild in May 2025.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
vBulletin · vBulletinpublic PoCs found — 7
githubgithub.com/0xgh057r3c0n/CVE-2025-48827★ 11githubgithub.com/SystemVll/CVE-2025-48827★ 1githubgithub.com/wiseep/CVE-2025-48827★ 0cve_referenceblog.kevintel.com/vbulletin-replaceadtemplate-kev/unverifiedvulncheckvulncheck.com/xdb/c1d326020292unverifiedvulncheckvulncheck.com/xdb/f518df068cf0unverifiedvulncheckvulncheck.com/xdb/7735baae66fcunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.