CVE-2025-48828
Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-05-27

Last updated on: 2025-06-25

Assigner: MITRE

Description
Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting template code in an alternative PHP function invocation syntax, such as the "var_dump"("test") syntax, attackers can bypass security checks and execute arbitrary PHP code, as exploited in the wild in May 2025.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2025-05-27
Last Modified
2025-06-25
Generated
2026-10-16
AI Q&A
2025-05-28
EPSS Evaluated
2026-10-14
NVD
CVE-2025-48828
EUVD
EUVD-2025-28268

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vbulletin vbulletin 6.0.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-424 The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting template code in an alternative PHP function invocation syntax, such as the "var_dump"("test") syntax, attackers can bypass security checks and execute arbitrary PHP code, as exploited in the wild in May 2025. [1]

Impact Analysis

This vulnerability allows attackers to execute arbitrary PHP code on affected vBulletin versions, which can lead to full system compromise, unauthorized access, data theft, or disruption of services. [1]

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-48828. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart