{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: vBulletin vulnerabilities","home_page_url":"https://patchfirst.co/vendor/vbulletin/","feed_url":"https://patchfirst.co/feed/vendor/vbulletin.json","description":"New and newly exploited vBulletin CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-61511","url":"https://patchfirst.co/cve/CVE-2026-61511/","title":"CVE-2026-61511: vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php","content_text":"vBulletin · vBulletin. Not in CISA KEV. EPSS 5.6% (higher than 92.9% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 77.2 of 100.","summary":"vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php","date_published":"2026-07-27T00:00:00.000Z","date_modified":"2026-10-14T03:56:22.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":77.2,"kev":null,"epss":{"score":0.05607,"percentile":0.92902},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"vBulletin","product":"vBulletin","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2025-48827","url":"https://patchfirst.co/cve/CVE-2025-48827/","title":"CVE-2025-48827: vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API…","content_text":"vBulletin · vBulletin. Not in CISA KEV. EPSS 75.6% (higher than 99.52% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. Priority 68.7 of 100.","summary":"vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API…","date_published":"2025-05-27T00:00:00.000Z","date_modified":"2025-05-27T18:03:31.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":68.7,"kev":null,"epss":{"score":0.75638,"percentile":0.9952},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"vBulletin","product":"vBulletin","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2025-48828","url":"https://patchfirst.co/cve/CVE-2025-48828/","title":"CVE-2025-48828: Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the…","content_text":"vBulletin · vBulletin. Not in CISA KEV. EPSS 57.3% (higher than 99.07% of CVEs). CVSS 9.0 CRITICAL. Public exploit code exists. Priority 67.2 of 100.","summary":"Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the…","date_published":"2025-05-27T00:00:00.000Z","date_modified":"2025-05-27T18:04:16.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":67.2,"kev":null,"epss":{"score":0.57297,"percentile":0.99074},"cvss":{"score":9,"severity":"CRITICAL","version":"3.1"},"vendor":"vBulletin","product":"vBulletin","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2019-16759#kev","url":"https://patchfirst.co/cve/CVE-2019-16759/","title":"[KEV] CVE-2019-16759: vBulletin PHP Module Remote Code Execution Vulnerability","content_text":"vBulletin · vBulletin. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 99.7% (higher than 99.95% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter; T1190 Exploit Public-Facing Application. Named in 1 threat report. Priority 73.7 of 100.","summary":"vBulletin PHP Module Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:22:44.000Z","tags":["kev","public-exploit","T1059","T1190"],"_patchfirst":{"reason":"kev","priority":73.7,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.99728,"percentile":0.99953},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"vBulletin","product":"vBulletin","techniqueIds":["T1059","T1190"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-17496#kev","url":"https://patchfirst.co/cve/CVE-2020-17496/","title":"[KEV] CVE-2020-17496: vBulletin PHP Module Remote Code Execution Vulnerability","content_text":"vBulletin · vBulletin. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 87.5% (higher than 99.76% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.8 of 100.","summary":"vBulletin PHP Module Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:59:01.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.87478,"percentile":0.99756},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"vBulletin","product":"vBulletin","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}}]}