CVE-2026-61511criticalobserved exploitationCWE-95

CVE-2026-61511: critical vulnerability in vBulletin

vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php

Published · Updated

Follow this CVE+ Monitor vBulletin

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

85Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 9.3epss 5.6%
from disclosure to weapon1 day
Published on NVDJul 27
1st PoC+1d
VulnCheck+31d
vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenav[pagenumber] parameter. Attackers can exploit the insufficiently restrictive regex filter by using phpfuck-style encoding with permitted characters to inject and execute arbitrary PHP code via the unauthenticated ajax/render template route without any authentication.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
vBulletin · vBulletin
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — vBulletin

In the same product, most dangerous first.

CVE-2025-48827CRITICALCVE-2025-48827EPSS 75.6%CVE-2025-48828CRITICALCVE-2025-48828EPSS 57.3%