What’s Vulnerable › Vulnerabilities

CVE-2025-48827

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 75.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-05-27 · updated 2026-06-17
• Weakness: CWE-424

Description

vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern, as exploited in the wild in May 2025.

Affected products

• vBulletin: from 5.0.0 through 5.7.5; from 6.0.0 through 6.0.3

References

• https://karmainsecurity.com/dont-call-that-protected-method-vbulletin-rce
• https://kevintel.com/CVE-2025-48827
• https://blog.kevintel.com/vbulletin-replaceadtemplate-kev/

Get alerted when CVE-2025-48827 or the next vulnerability affects your stack