Description
vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern, as exploited in the wild in May 2025.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| vBulletin | vBulletin | 5.0.0 – ≤ 5.7.5, 6.0.0 – ≤ 6.0.3 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
vBulletin replaceAdTemplate Remote Code Execution
exploit/multi/http/vbulletin_replace_ad_template_rce
GitHub 3 repositories
-
0xgh057r3c0n/CVE-2025-48827 ★ 11 · May 29, 2025
Critical Unauthenticated API Access in vBulletin
-
sh4den/CVE-2025-48827 ★ 1 · Jul 14, 2025
This repository contains a proof-of-concept exploit for CVE-2025-48827, a critical authentication bypass vulnerability affecting vBulletin 5.0.0–5.7.5 and 6.0.0–6.0.3 when running on PHP 8.1 or later…
-
wiseep/CVE-2025-48827 ★ 0 · May 31, 2025
Vbullettin RCE - CVE-2025-48827
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- vBulletin 5.0.0-6.0.3 - Authentication Bypass http/cves/2025/CVE-2025-48827.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Advisories 1
- WID-SEC-2025-1148 vBulletin Connect: Mehrere Schwachstellen ermöglichen Codeausführung BSI CERT-Bund (WID) · Jun 1, 2025