{"basis":"claimed","id":"CVE-2025-48828","name":"vBulletin vBulletin","vendorProject":"vBulletin","product":"vBulletin","publishedAt":"2025-05-27","cvss":{"score":9,"severity":"CRITICAL","version":"3.1"},"exploited":null,"epss":{"score":0.57297,"percentile":0.99075,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"blocks","firstOn":"2025-06-16","daysToRule":20},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"none","firstOn":null,"daysToRule":null},"fastly":{"status":"no_history","firstOn":null,"daysToRule":null},"f5":{"status":"rule","firstOn":"2025-08-15","daysToRule":80},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":null,"description":"Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting template code in an alternative PHP function invocation syntax, such as the \"var_dump\"(\"test\") syntax, attackers can bypass security checks and execute arbitrary PHP code, as exploited in the wild in May 2025.","cwes":["CWE-424"],"vendors":[{"vendor":"cloudflare","status":"blocks","basis":"claimed","firstOn":"2025-06-16","firstIsNew":true,"daysToRule":20,"daysAtMost":null,"freePlan":false,"claims":[{"id":"3b8150e5cc308c2b03b08068a788cc92069ce781b50c0bf0e645d3c568e4fb24","cve_id":"CVE-2025-48828","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"2672b175a25548aa8e0107b12e1648d2","rule_name":"vBulletin - Remote Code Execution - CVE:CVE-2025-48827, CVE:CVE-2025-48828","change":"new","default_action":"Block","published_on":"2025-06-16","source_url":"https://developers.cloudflare.com/changelog/post/2025-06-16-waf-release/","source_title":"WAF Release - 2025-06-16","excerpt":"vBulletin - Remote Code Execution - CVE:CVE-2025-48827, CVE:CVE-2025-48828. Previous action: Log. New action: Block. This is a New Detection","first_seen_at":"2026-11-02T21:00:16.350Z"}]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"rule","basis":"claimed","firstOn":"2025-08-15","firstIsNew":true,"daysToRule":80,"daysAtMost":null,"freePlan":false,"claims":[{"id":"7d8ee236f0b73c6963184c2529c9864d41f38da9e47f8f09a978a81a48990d24","cve_id":"CVE-2025-48828","vendor":"f5","product":"Attack signatures","rule_id":"200204021","rule_name":"vBulletin replaceAdTemplate Remote Code Execution","change":"new","default_action":null,"published_on":"2025-08-15","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200204021 \"vBulletin replaceAdTemplate Remote Code Execution\" (Server Side Code Injection, risk High), systems: PHP. References: CVE-2025-48828, CVE-2025-48827.","first_seen_at":"2026-11-02T21:00:25.702Z"}]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-02T21:16:34.613Z","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total"},"measured":[{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 1, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:02:57.000Z","verdict":"partial","templateId":"CVE-2025-48828","templatePath":"http/cves/2025/CVE-2025-48828.yaml","requests":2,"blockedRequests":1,"rules":["933150"],"note":"","requestDetail":[{"method":"POST","path":"/","status":403,"blocked":true,"rules":["933150"]},{"method":"POST","path":"/","status":200,"blocked":false,"rules":[]}]},{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 2, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:03:28.000Z","verdict":"partial","templateId":"CVE-2025-48828","templatePath":"http/cves/2025/CVE-2025-48828.yaml","requests":2,"blockedRequests":1,"rules":["932200","932240","933150","942340","942430","942520"],"note":"","requestDetail":[{"method":"POST","path":"/","status":403,"blocked":true,"rules":["932200","932240","933150","942340","942430","942520"]},{"method":"POST","path":"/","status":200,"blocked":false,"rules":[]}]}],"social":{"total":0,"first_seen":null,"daily":[{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":0},{"day":"2026-11-03","posts":0}],"top_posts":[],"exploit_repositories":[]}}