cve-2025-48828

CRITICAL CVSS 9.0 opencve
Description

Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting template code in an alternative PHP function invocation syntax, such as the "var_dump"("test") syntax, attackers can bypass security checks and execute arbitrary PHP code, as exploited in the wild in May 2025.

Timeline
Published
2025-05-27 04:15 UTC
Last Modified
2026-06-17
CVSS Details

CVSS details not available.

Affected Products

No product information available.

Weaknesses (CWE)
CVSS metrics
Version Base Severity Vector Exploitability Impact Source
3.1 9.0 CRITICAL CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H mitre
3.1 9.0 CRITICAL CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H nvd
3.1 9.0 CRITICAL CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H opencve
References

No references available.

Linked Vulnerabilities

No linked vulnerabilities found.

{
  "cve": "CVE-2025-48828",
  "enrichment": {
    "created": "2025-06-24T09:44:17.717826+00:00",
    "updated": "2025-06-24T09:44:17.717937+00:00",
    "vendors": [
      "vbulletin",
      "vbulletin$PRODUCT$vbulletin"
    ]
  },
  "epss": {
    "score": 0.5764
  },
  "mitre": {
    "cpes": [],
    "created": "2025-05-27T00:00:00+00:00",
    "description": "Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting template code in an alternative PHP function invocation syntax, such as the \"var_dump\"(\"test\") syntax, attackers can bypass security checks and execute arbitrary PHP code, as exploited in the wild in May 2025.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 9,
        "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
      },
      "cvssV4_0": {}
    },
    "mitre_repo_path": "cves/2025/48xxx/CVE-2025-48828.json",
    "references": [
      "https://karmainsecurity.com/dont-call-that-protected-method-vbulletin-rce",
      "https://kevintel.com/CVE-2025-48828"
    ],
    "title": null,
    "updated": "2025-05-27T18:04:16.774000+00:00",
    "vendors": [],
    "weaknesses": [
      "CWE-424"
    ]
  },
  "nvd": {
    "cpes": [
      "cpe:2.3:a:vbulletin:vbulletin:6.0.3:*:*:*:*:*:*:*"
    ],
    "created": "2025-05-27T04:15:45.033000+00:00",
    "description": "Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting template code in an alternative PHP function invocation syntax, such as the \"var_dump\"(\"test\") syntax, attackers can bypass security checks and execute arbitrary PHP code, as exploited in the wild in May 2025.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 9.0,
        "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
      },
      "cvssV4_0": {}
    },
    "nvd_repo_path": "2025/CVE-2025-48828.json",
    "references": [
      "https://blog.kevintel.com/vbulletin-replaceadtemplate-kev/",
      "https://karmainsecurity.com/dont-call-that-protected-method-vbulletin-rce",
      "https://kevintel.com/CVE-2025-48828"
    ],
    "title": null,
    "updated": "2026-06-17T09:30:23.530000+00:00",
    "vendors": [
      "vbulletin",
      "vbulletin$PRODUCT$vbulletin"
    ],
    "weaknesses": [
      "CWE-424"
    ]
  },
  "opencve": {
    "changes": [
      {
        "created": "2025-05-27T04:15:00+00:00",
        "data": [
          {
            "details": {
              "new": "Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting template code in an alternative PHP function invocation syntax, such as the \"var_dump\"(\"test\") syntax, attackers can bypass security checks and execute arbitrary PHP code.",
              "old": null
            },
            "type": "description"
          },
          {
            "details": {
              "added": [
                "CWE-424"
              ],
              "removed": []
            },
            "type": "weaknesses"
          },
          {
            "details": {
              "added": [
                "https://karmainsecurity.com/dont-call-that-protected-method-vbulletin-rce"
              ],
              "removed": []
            },
            "type": "references"
          },
          {
            "details": {
              "added": {
                "cvssV3_1": {
                  "score": 9,
                  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
                }
              },
              "removed": {},
              "updated": {}
            },
            "type": "metrics"
          }
        ],
        "id": "8cc788c0-83af-4445-97e8-88cb4208ceea"
      },
      {
        "created": "2025-05-27T13:00:00+00:00",
        "data": [
          {
            "details": {
              "new": "Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting template code in an alternative PHP function invocation syntax, such as the \"var_dump\"(\"test\") syntax, attackers can bypass security checks and execute arbitrary PHP code, as exploited in the wild in May 2025.",
              "old": "Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting template code in an alternative PHP function invocation syntax, such as the \"var_dump\"(\"test\") syntax, attackers can bypass security checks and execute arbitrary PHP code."
            },
            "type": "description"
          },
          {
            "details": {
              "added": [
                "https://kevintel.com/CVE-2025-48828"
              ],
              "removed": []
            },
            "type": "references"
          }
        ],
        "id": "fc6a3176-0d7b-488c-a84c-59da3906c941"
      },
      {
        "created": "2025-05-27T14:15:00+00:00",
        "data": [
          {
            "details": {
              "added": {
                "ssvc": {
                  "options": {
                    "Automatable": "yes",
                    "Exploitation": "active",
                    "Technical Impact": "total"
                  },
                  "version": "2.0.3"
                }
              },
              "removed": {},
              "updated": {}
            },
            "type": "metrics"
          }
        ],
        "id": "99707aa8-5bb4-4b8a-bad6-053f4ccd2386"
      },
      {
        "created": "2025-05-27T16:15:00+00:00",
        "data": [
          {
            "details": {
              "added": {},
              "removed": {},
              "updated": {
                "ssvc": {
                  "new": {
                    "options": {
                      "Automatable": "yes",
                      "Exploitation": "poc",
                      "Technical Impact": "total"
                    },
                    "version": "2.0.3"
                  },
                  "old": {
                    "options": {
                      "Automatable": "yes",
                      "Exploitation": "active",
                      "Technical Impact": "total"
                    },
                    "version": "2.0.3"
                  }
                }
              }
            },
            "type": "metrics"
          }
        ],
        "id": "aa0e993a-6877-46b7-bdcf-3aa399689f05"
      },
      {
        "created": "2025-05-27T18:15:00+00:00",
        "data": [
          {
            "details": {
              "added": [
                "https://blog.kevintel.com/vbulletin-replaceadtemplate-kev/"
              ],
              "removed": []
            },
            "type": "references"
          },
          {
            "details": {
              "added": {},
              "removed": {},
              "updated": {
                "ssvc": {
                  "new": {
                    "options": {
                      "Automatable": "no",
                      "Exploitation": "poc",
                      "Technical Impact": "total"
                    },
                    "version": "2.0.3"
                  },
                  "old": {
                    "options": {
                      "Automatable": "yes",
                      "Exploitation": "poc",
                      "Technical Impact": "total"
                    },
                    "version": "2.0.3"
                  }
                }
              }
            },
            "type": "metrics"
          }
        ],
        "id": "c7e4f56f-9898-4d21-8247-05d283f084db"
      },
      {
        "created": "2025-06-25T17:15:00+00:00",
        "data": [
          {
            "details": [
              "vbulletin",
              "vbulletin$PRODUCT$vbulletin"
            ],
            "type": "first_time"
          },
          {
            "details": {
              "added": [
                "cpe:2.3:a:vbulletin:vbulletin:6.0.3:*:*:*:*:*:*:*"
              ],
              "removed": []
            },
            "type": "cpes"
          },
          {
            "details": {
              "added": [
                "vbulletin",
                "vbulletin$PRODUCT$vbulletin"
              ],
              "removed": []
            },
            "type": "vendors"
          }
        ],
        "id": "167ad42f-e3c8-473a-9cce-4135e449fa62"
      }
    ],
    "cpes": {
      "data": [
        "cpe:2.3:a:vbulletin:vbulletin:6.0.3:*:*:*:*:*:*:*"
      ],
      "providers": [
        "nvd"
      ]
    },
    "created": {
      "data": "2025-05-27T00:00:00+00:00",
      "provider": "mitre"
    },
    "description": {
      "data": "Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting template code in an alternative PHP function invocation syntax, such as the \"var_dump\"(\"test\") syntax, attackers can bypass security checks and execute arbitrary PHP code, as exploited in the wild in May 2025.",
      "provider": "mitre"
    },
    "metrics": {
      "cvssV2_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_1": {
        "data": {
          "score": 9,
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
        },
        "provider": "mitre"
      },
      "cvssV4_0": {
        "data": {},
        "provider": null
      },
      "epss": {
        "data": {
          "score": 0.5764
        },
        "provider": "first"
      },
      "kev": {
        "data": {},
        "provider": null
      },
      "ssvc": {
        "data": {
          "options": {
            "Automatable": "no",
            "Exploitation": "poc",
            "Technical Impact": "total"
          },
          "version": "2.0.3"
        },
        "provider": "vulnrichment"
      },
      "threat_severity": {
        "data": null,
        "provider": null
      }
    },
    "references": {
      "data": [
        "https://blog.kevintel.com/vbulletin-replaceadtemplate-kev/",
        "https://karmainsecurity.com/dont-call-that-protected-method-vbulletin-rce",
        "https://kevintel.com/CVE-2025-48828"
      ],
      "providers": [
        "mitre",
        "nvd",
        "vulnrichment"
      ]
    },
    "title": {
      "data": null,
      "provider": null
    },
    "updated": {
      "data": "2025-06-25T16:32:38.947000+00:00",
      "provider": "nvd"
    },
    "vendors": {
      "data": [
        "vbulletin",
        "vbulletin$PRODUCT$vbulletin"
      ],
      "providers": [
        "nvd",
        "enrichment"
      ]
    },
    "weaknesses": {
      "data": [
        "CWE-424"
      ],
      "providers": [
        "mitre",
        "nvd"
      ]
    }
  },
  "vulnrichment": {
    "cpes": [],
    "created": "2025-05-27T00:00:00+00:00",
    "description": "Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting template code in an alternative PHP function invocation syntax, such as the \"var_dump\"(\"test\") syntax, attackers can bypass security checks and execute arbitrary PHP code, as exploited in the wild in May 2025.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {},
      "cvssV4_0": {},
      "kev": {},
      "ssvc": {
        "options": {
          "Automatable": "no",
          "Exploitation": "poc",
          "Technical Impact": "total"
        },
        "version": "2.0.3"
      }
    },
    "references": [
      "https://blog.kevintel.com/vbulletin-replaceadtemplate-kev/"
    ],
    "title": null,
    "updated": "2025-05-27T13:59:25.699000+00:00",
    "vendors": [],
    "vulnrichment_repo_path": "2025/48xxx/CVE-2025-48828.json",
    "weaknesses": []
  }
}
Enrichment data
Nuclei templates
Aggregated bundle (all enrichments)
View JSON API Download JSON