{"id":"CVE-2025-48828","published":"2025-05-27T00:00:00Z","modified":"2025-05-27T18:04:16Z","title":"Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the…","vendor":"vBulletin","product":"vBulletin","tier":"core","eol":null,"affectedVersions":[{"vendor":"vBulletin","product":"vBulletin","versions":["6.0.3"]}],"description":{"text":"Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting template code in an alternative PHP function invocation syntax, such as the \"var_dump\"(\"test\") syntax, attackers can bypass security checks and execute arbitrary PHP code, as exploited in the wild in May 2025.","provenance":"source","from":"CVE.org"},"summary":{"text":"A flaw in the Template Conditionals handling of the vBulletin template engine lets certain vBulletin versions run arbitrary PHP code. An attacker can do this by crafting template code that uses an alternative PHP function invocation syntax to bypass security checks, requiring only network access with no authentication or user interaction, though exploitation is conditional on a high-complexity setup.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:12:00Z"},"cvss":{"score":9,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.57297,"percentile":0.99072,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-05-26","exploitedFirstSeen":"2025-05-26","ransomware":false,"evidence":[{"url":"https://blog.kevintel.com/vbulletin-replaceadtemplate-kev/","date":"2025-05-26"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-48828","date":"2025-05-27"},{"url":"https://isc.sans.edu/diary/rss/32006","date":"2025-06-03"},{"url":"https://falconfeeds.io/blogs/unmasking-handala-iran-cyber-threat-psyops","date":"2025-06-16"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":{"pulseCount":2,"pulses":[{"name":"Public Exploit Released for Patched vBulletin Pre-Auth Code Execution Flaw [The Hacker News]","url":"https://otx.alienvault.com/pulse/6a6da70f3277762e928fe693","created":"2026-08-01"},{"name":"vBulletin CVE-2026-61511 Pre-Auth Template Engine RCE (Public Exploit)","url":"https://otx.alienvault.com/pulse/6a68463a2310c6ff666b151b","created":"2026-07-28"}],"provenance":"machine"},"cwes":[{"id":"CWE-424","name":"Improper Protection of Alternate Path"}],"references":[{"url":"https://karmainsecurity.com/dont-call-that-protected-method-vbulletin-rce","tags":[]},{"url":"https://kevintel.com/CVE-2025-48828","tags":[]},{"url":"https://blog.kevintel.com/vbulletin-replaceadtemplate-kev/","tags":["exploit"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-28268","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-28268","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2025-06-25","earliestUrl":"https://github.com/ill-deed/vBulletin-CVE-2025-48828-Multi-target","repos":[{"name":"ill-deed/vBulletin-CVE-2025-48828-Multi-target","url":"https://github.com/ill-deed/vBulletin-CVE-2025-48828-Multi-target","stars":0,"created":"2025-06-25"}]},"metasploit":[{"name":"vBulletin replaceAdTemplate Remote Code Execution","module":"exploit/multi/http/vbulletin_replace_ad_template_rce","type":"exploit","disclosureDate":"2025-05-23","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/vbulletin_replace_ad_template_rce.rb"}],"nuclei":[{"id":"CVE-2025-48828","name":"vBulletin replaceAdTemplate - Remote Code Execution","severity":"critical","path":"http/cves/2025/CVE-2025-48828.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-48828.yaml"}],"first":{"date":"2025-05-23","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/vbulletin_replace_ad_template_rce.rb"},"provenance":"source"},"exploitRefs":["https://blog.kevintel.com/vbulletin-replaceadtemplate-kev/"],"flow":[],"timeline":[{"date":"2025-05-23","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2025-06-25","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/vbulletin_replace_ad_template_rce.rb","provenance":"source"},{"date":"2025-05-26","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blog.kevintel.com/vbulletin-replaceadtemplate-kev/","provenance":"source"},{"date":"2025-05-27","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-48828","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":67.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 522 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.81,"detail":"percentile 0.9907"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 PoC-in-GitHub repo; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":1.08,"detail":"2 pulses"},{"name":"CVSS severity","points":6.3,"detail":"base score 9"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}