https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-46171.htmlhttps://patchthecve.com/cve/CVE-2025-46171.htmlSun, 05 Jul 2026 01:21:47 +0000MEDIUM 5.4: vBulletin 3.8.7 is vulnerable to a denial-of-service condition via the misc.php?do=buddylist endpoint. If an authenticated user has a sufficiently large buddy list, processing the list can consume excessive memory, exhausting system resources and crashing the forum.https://patchthecve.com/cve/CVE-2025-48828.htmlhttps://patchthecve.com/cve/CVE-2025-48828.htmlWed, 17 Jun 2026 09:30:23 +0000CRITICAL 9.0: Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting template code in an alternative PHP function invocation syntax, such as the "var_dump"("test") syntax, attackers can bypass security checks and execute https://patchthecve.com/cve/CVE-2025-48827.htmlhttps://patchthecve.com/cve/CVE-2025-48827.htmlWed, 17 Jun 2026 09:30:23 +0000CRITICAL 10.0: vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern, as exploited in the wild in May 2025.