CVE-2025-4882710.0CriticalCWE-424
No description published yet
Vendor not yet named
Not in CISA KEV
75.8%probability of exploitation in the next 30 days
99th percentile
050100
Higher than 99% of scored CVEs
10.0CriticalCVSS 3.1
LowMediumHighCrit.
DescriptionNVD
vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern, as exploited in the wild in May 2025.
Coverage1 article · 1 outlet
First in our coverage: Security Affairs, 25 Mar.
- Two flaws in vBulletin forum software are under attackSecurity Affairs · first in our coverage
New articles also arrive in the RSS feed.