CVE-2023-25135

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 23.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-02-03 · updated 2026-06-17
Weakness: CWE-502

Description

vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This occurs because verify_serialized checks that a value is serialized by calling unserialize and then checking for errors. The fixed versions are 5.6.7 PL1, 5.6.8 PL1, and 5.6.9 PL1.

Affected products

vBulletin: 5.6.7, 5.6.8, 5.6.9

References

https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4473890-vbulletin-5-6-9-security-patch
https://www.ambionics.io/blog/vbulletin-unserializable-but-unreachable
https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4473890-vbulletin-5-6-9-security-patch
https://www.ambionics.io/blog/vbulletin-unserializable-but-unreachable

Get alerted when CVE-2023-25135 or the next vulnerability affects your stack