PatchTheCVEvbulletin vulnerabilities
Recent CVEs affecting vbulletin products. 3 tracked.
vbulletin has 3 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 2. Most recent: 2025-07-23. Highest priority: CVE-2025-48827 (score 73/100).
- CVE-2025-46171 MEDIUM 5.4 DOWNGRADE vBulletin 3.8.7 is vulnerable to a denial-of-service condition via the misc.php?do=buddylist endpoint
- CVE-2025-48828 CRITICAL 9.0 DOWNGRADE Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditional
- CVE-2025-48827 CRITICAL 10.0 UPGRADE vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API con
FAQ
How do I fix vbulletin vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is vbulletin being exploited right now?
None of the tracked vbulletin CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which vbulletin CVE should I patch first?
CVE-2025-48827 currently ranks highest (73/100): vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API con.