{"id":"CVE-2026-61511","published":"2026-07-27T12:39:16Z","modified":"2026-10-14T03:56:22Z","title":"vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php","vendor":"vBulletin","product":"vBulletin","tier":"core","eol":null,"affectedVersions":[{"vendor":"vBulletin","product":"vBulletin","versions":[">= 5.0.0, <= 5.7.5",">= 6.0.0, <= 6.2.1"]}],"description":{"text":"vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenav[pagenumber] parameter. Attackers can exploit the insufficiently restrictive regex filter by using phpfuck-style encoding with permitted characters to inject and execute arbitrary PHP code via the unauthenticated ajax/render template route without any authentication.","provenance":"source","from":"CVE.org"},"summary":{"text":"vBulletin versions 5.x through 5.7.5 and 6.x through 6.2.1 contain an eval injection flaw in the vB5_Template_Runtime::runMaths() method of the template runtime (vb5/template/runtime.php). An unauthenticated remote attacker can reach it over the network through the ajax/render template route by supplying crafted pagenav[pagenumber] input, using encoded PHP that passes an insufficient regex filter, to run arbitrary PHP code on the server without authentication or user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:54:05Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.05607,"percentile":0.92913,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-08-27","exploitedFirstSeen":"2026-08-27","ransomware":false,"evidence":[{"url":"https://previdian.com/CVE-2026-61511","date":"2026-08-27"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-95","name":"Improper Neutralization of Directives in Dynamically Evaluated Code"}],"references":[{"url":"https://karmainsecurity.com/KIS-2026-13","tags":["technical-description","exploit"]},{"url":"https://ssd-disclosure.com/vbulletin-runtime-template-runmaths-preauth-rce/","tags":["technical-description","exploit"]},{"url":"https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4509358-security-patch-released-for-vbulletin-6-2-1-6-2-0-and-6-1-6","tags":[]},{"url":"https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4509404-vbulletin-6-2-2-is-available","tags":[]},{"url":"https://www.vulncheck.com/advisories/vbulletin-eval-injection-rce-via-vb5-template-runtime-php","tags":["third-party-advisory"]},{"url":"http://seclists.org/fulldisclosure/2026/Aug/29","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-49312","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-49312","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":4,"skipped":1,"earliest":"2026-07-28","earliestUrl":"https://github.com/HORKimhab/CVE-2026-61511","repos":[{"name":"tc4dy/CVE-2026-61511-PoC-Exploit","url":"https://github.com/tc4dy/CVE-2026-61511-PoC-Exploit","stars":6,"created":"2026-07-29"},{"name":"puj790201-lab/cve-2026-61511","url":"https://github.com/puj790201-lab/cve-2026-61511","stars":3,"created":"2026-07-28"},{"name":"HORKimhab/CVE-2026-61511","url":"https://github.com/HORKimhab/CVE-2026-61511","stars":0,"created":"2026-07-28"},{"name":"codeb0ssx/Ultimate-CVE-2026-61511","url":"https://github.com/codeb0ssx/Ultimate-CVE-2026-61511","stars":0,"created":"2026-07-29"}]},"nuclei":[{"id":"CVE-2026-61511","name":"vBulletin 6.x - Remote Code Execution","severity":"critical","path":"http/cves/2026/CVE-2026-61511.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-61511.yaml"}],"first":{"date":"2026-07-28","source":"PoC-in-GitHub","url":"https://github.com/HORKimhab/CVE-2026-61511"},"provenance":"source"},"exploitRefs":["https://karmainsecurity.com/KIS-2026-13","https://ssd-disclosure.com/vbulletin-runtime-template-runmaths-preauth-rce/"],"flow":[],"timeline":[{"date":"2026-07-27","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2026-61511","provenance":"source"},{"date":"2026-07-28","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/HORKimhab/CVE-2026-61511","provenance":"source"},{"date":"2026-08-27","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://previdian.com/CVE-2026-61511","provenance":"source"}],"speed":{"daysToPublicExploit":1,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":75.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 66 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":18.58,"detail":"percentile 0.9291"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 4 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}