CVE-2026-61511
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk67th percentile - higher than 67% of all known CVEs
Summary
vBulletin versions 5.x through 5.7.5 and 6.x through 6.2.1 contain an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method, allowing unauthenticated remote attackers to execute arbitrary PHP code via crafted pagenav[pagenumber] parameter.
Risk Assessment
An attacker could fully compromise the vBulletin server, execute arbitrary code, and access sensitive data.
Recommendation
Update vBulletin to the latest available version (above 5.7.5 or 6.2.1).
Original NVD description (English source)
vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenav[pagenumber] parameter. Attackers can exploit the insufficiently restrictive regex filter by using phpfuck-style encoding with permitted characters to inject and execute arbitrary PHP code via the unauthenticated ajax/render template route without any authentication.