Vulnerability intelligence

CVE-2026-61511

vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenav[pagenumber] parameter. Attackers can exploit the insufficiently restrictive regex filter by using phpfuck-style encoding with permitted characters to inject and execute arbitrary PHP code via the unauthenticated ajax/render template route without any authentication.

CVSS Score

9.3

Critical

EPSS — Exploit Probability

71%

Riskier than 99% of all CVEs · checked 2026-09-09

Exploitation

Not in CISA KEV

KEV does not include every exploited vulnerability

Remediation

unknown

Check vendor advisories

NVD entry

1 article across 1 outlet · first covered Jul 27, 2026 · latest Jul 27, 2026

Coverage timeline

PoC Released for Severe vBulletin RCE Flaw CVE-2026-61511
securityonline.info · Jul 27, 2026