CVE-2025-488289.0CriticalCWE-424
No description published yet
Vendor not yet named
Not in CISA KEV
57.6%probability of exploitation in the next 30 days
99th percentile
050100
Higher than 99% of scored CVEs
9.0CriticalCVSS 3.1
LowMediumHighCrit.
DescriptionNVD
Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting template code in an alternative PHP function invocation syntax, such as the "var_dump"("test") syntax, attackers can bypass security checks and execute arbitrary PHP code, as exploited in the wild in May 2025.
Coverage1 article · 1 outlet
First in our coverage: Security Affairs, 25 Mar.
- Two flaws in vBulletin forum software are under attackSecurity Affairs · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.