Skip to content
Threat Feed
Subscribe

Product

VBulletin (< 6.2.2)

1 brief RSS
critical advisory

Critical Eval Injection Vulnerability in vBulletin Allows Remote Code Execution (CVE-2026-61511)

An eval injection vulnerability, identified as CVE-2026-61511, exists in vBulletin versions 5.x through 5.7.5 and 6.x through 6.2.1, specifically within the vB5_Template_Runtime::runMaths() method, allowing unauthenticated remote attackers to achieve arbitrary PHP code execution by manipulating the pagenav[pagenumber] parameter through the unauthenticated ajax/render template route with phpfuck-style encoding.

PoC vBulletin 5.x through 5.7.5 +4 web-vulnerability remote-code-execution eval-injection php unauthenticated
1r 2t 3c 4i