CVE-2025-48828

Katalog CVE

CVSS 8.1 · High EPSS 57,6%

Kerentanan Improper Protection of Alternate Path pada vbulletin. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting template code in an alternative PHP function invocation syntax, such as the "var_dump"("test") syntax, attackers can bypass security checks and execute arbitrary PHP code, as exploited in the wild in May 2025.

Rincian

Terbit di NVD

27 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-424: Improper Protection of Alternate Path

EPSS (30 hari)

57,6% peluang dieksploitasi; lebih tinggi dari 99,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://karmainsecurity.com/dont-call-that-protected-method-vbulletin-rce exploit · advisory pihak ketiga
• https://kevintel.com/CVE-2025-48828 advisory pihak ketiga
• https://blog.kevintel.com/vbulletin-replaceadtemplate-kev/ broken link