{"id":"CVE-2025-48827","aliases":["EUVD-2025-28267","GHSA-23fp-mrfv-cwv4"],"status":"published","title":"vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke...","description":"vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern, as exploited in the wild in May 2025.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.75638,"percentile":0.99524,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-424"],"published":"2025-05-27T00:00:00Z","modified":"2026-06-17T09:30:23Z","exploits":[{"source":"metasploit","id":"exploit/multi/http/vbulletin_replace_ad_template_rce","title":"vBulletin replaceAdTemplate Remote Code Execution","type":"exploit","platform":"Linux,Unix,Windows","date":"2025-05-23","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/vbulletin_replace_ad_template_rce"},{"source":"nuclei","id":"CVE-2025-48827","title":"vBulletin 5.0.0-6.0.3 - Authentication Bypass","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-48827.yaml"},{"source":"pocgithub","id":"0xgh057r3c0n/CVE-2025-48827","title":"0xgh057r3c0n/CVE-2025-48827","date":"2025-05-29","url":"https://github.com/0xgh057r3c0n/CVE-2025-48827"},{"source":"pocgithub","id":"sh4den/CVE-2025-48827","title":"sh4den/CVE-2025-48827","date":"2025-07-14","url":"https://github.com/sh4den/CVE-2025-48827"},{"source":"pocgithub","id":"wiseep/CVE-2025-48827","title":"wiseep/CVE-2025-48827","date":"2025-05-31","url":"https://github.com/wiseep/CVE-2025-48827"}],"products":[{"vendor":"vbulletin","product":"vbulletin"}],"references":[{"url":"https://karmainsecurity.com/dont-call-that-protected-method-vbulletin-rce","tags":["Exploit","Third Party Advisory"]},{"url":"https://kevintel.com/CVE-2025-48827","tags":["Third Party Advisory"]},{"url":"https://blog.kevintel.com/vbulletin-replaceadtemplate-kev/","tags":["exploit","Broken Link"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48827"},{"url":"https://blog.kevintel.com/vbulletin-replaceadtemplate-kev"},{"url":"https://github.com/advisories/GHSA-23fp-mrfv-cwv4"}],"sources":{"cve":[{"id":"CVE-2025-48827","description":"vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern, as exploited in the wild in May 2025.","status":"published","published":"2025-05-27T00:00:00Z","modified":"2025-05-27T18:03:31.961Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-424"],"updated_at":"2026-11-02T14:32:41.41198Z"}],"euvd":[{"id":"EUVD-2025-28267","description":"vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern, as exploited in the wild in May 2025.","status":"published","published":"2025-05-27T00:00:00Z","modified":"2025-05-27T18:03:31Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:32:37.949923Z"}],"ghsa":[{"id":"GHSA-23fp-mrfv-cwv4","title":"vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke...","description":"vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern.","status":"published","published":"2025-05-27T06:30:34Z","modified":"2025-05-27T18:30:49Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-424"],"updated_at":"2026-11-02T15:02:27.370745Z"}],"nvd":[{"id":"CVE-2025-48827","description":"vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern, as exploited in the wild in May 2025.","status":"published","published":"2025-05-27T04:15:41.23Z","modified":"2026-06-17T09:30:23.407Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-424"],"updated_at":"2026-11-02T14:11:09.562272Z"}]}}