CyberSec.Space Logo
返回 CVE 瀏覽器

CVE-2025-48827

CRITICAL
10.0
CVSS Severity Score
EPSS Score0.0000%
EPSS Percentile0.00th
Published2025-05-27
Last Modified2026-06-17
Data SourcesNVD

Vulnerability Description

vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern, as exploited in the wild in May 2025.

Affected Platforms (CPE)

📦
Vbulletin

Vbulletin

>= 5.0.0 and <= 5.7.5>= 6.0.0 and <= 6.0.3

References & Advisories

🔗 https://karmainsecurity.com/dont-call-that-protected-method-vbulletin-rce
🔗 https://kevintel.com/CVE-2025-48827
🔗 https://blog.kevintel.com/vbulletin-replaceadtemplate-kev/

相關漏洞威脅

CVE-2026-615119.3

vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths()...

CVE-2025-461715.4

vBulletin 3.8.7 is vulnerable to a denial-of-service condition via the misc.php?do=buddylist endpoint. If an authenticated user ha...

CVE-2025-488289.0

Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template en...

CVE-2023-397775.4

A cross-site scripting (XSS) vulnerability in the Admin Control Panel of vBulletin 5.7.5 and 6.0.0 allows attackers to execute arb...