VYPR
← All advisories
Critical severity10.0NVD Advisory· Published May 27, 2025· Updated Jun 17, 2026

CVE-2025-48827

CVE-2025-48827

Description

vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern, as exploited in the wild in May 2025.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Jelsoft/Vbulletinv53 versions
    5.0.0+ 2 more
    • (no CPE)range: 5.0.0
    • cpe:2.3:a:vbulletin:vbulletin:*:*:*:*:*:*:*:*range: >=5.0.0,<=5.7.5
    • (no CPE)range: 5.0.0 - 5.7.5, 6.0.0 - 6.0.3

Patches

Vulnerability mechanics

References

3

News mentions

1