CVE-2025-48827

Katalog CVE

CVSS 9.8 · Critical EPSS 75,8%

Kerentanan Improper Protection of Alternate Path pada vbulletin. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern, as exploited in the wild in May 2025.

Rincian

Terbit di NVD

27 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-424: Improper Protection of Alternate Path

EPSS (30 hari)

75,8% peluang dieksploitasi; lebih tinggi dari 99,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://karmainsecurity.com/dont-call-that-protected-method-vbulletin-rce exploit · advisory pihak ketiga
• https://kevintel.com/CVE-2025-48827 advisory pihak ketiga
• https://blog.kevintel.com/vbulletin-replaceadtemplate-kev/ broken link