Search
Find a vulnerability
Search criteria
2 vulnerabilities found for vBulletin by unknown
GCVE-1988-2026-0287
Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-09-08 11:40
VLAI
EPSS
VEX
Title
[KIS-2026-13] vBulletin <= 6.2.1 (runMaths) Remote Code Execution Vulnerability
Summary
-----------------------------------------------------------------
vBulletin <= 6.2.1 (runMaths) Remote Code Execution Vulnerability
-----------------------------------------------------------------
[-] Software Link:
https://www.vbulletin.com
[-] Affected Versions:
Version 5.7.5 and prior 5.x versions.
Version 6.2.1 and prior 6.x versions.
[-] Vulnerability Description:
The vulnerable code is located within the
/includes/vb5/template/runtime.php script. Specifically, into the
vB5_Template_Runtime::runMaths() method: the $str parameter is not
sufficiently sanitized before being used in an eval() call. The regex used
to validate the input parameter will filter the string only allowing for
digits, parentheses, math and binary operators (the XOR, particularly). As
such, this can be exploited to inject and execute (semi) arbitrary PHP code
through "phpfuck" techniques. The vulnerability could be exploited by e.g.
administrator users, by editing a template/style in the admin panel and
adding a specially crafted {vb:math} tag (which is a sort of wrapper around
the vB5_Template_Runtime::runMaths() method). However, this can also be
exploited by unauthenticated attackers by abusing the
ajax/render/[template] route, rendering a template which uses the {vb:math}
tag with an user-tainted parameter. One of the possible templates that can
be abused that way is the default "pagenav" template: here, user input
passed through the "pagenav[pagenumber]" parameter will be assigned to the
"pagenav.currentpage" template variable, which is later used within a
{vb:math} tag, thus passed to the vB5_Template_Runtime::runMaths() method,
which in turn will pass this string to eval(), eventually resulting in
execution of (semi) arbitrary PHP code on the web server.
[-] Proof of Concept:
https://karmainsecurity.com/pocs/CVE-2026-61511.php
[-] Solution:
Apply the vendor patch or upgrade to version 6.2.2 or later.
[-] Disclosure Timeline:
[25/06/2026] - Vendor was notified by SSD Secure Disclosure
[30/06/2026] - Vendor released security patch to address this issue:
https://tinyurl.com/vb-patch
[01/07/2026] - Vendor released version 6.2.2: https://tinyurl.com/vb-622
[13/07/2026] - CVE identifier requested
[13/07/2026] - CVE identifier assigned
[27/07/2026] - Public disclosure
[-] CVE Reference:
CVE-2026-61511 has been assigned to this vulnerability.
[-] Credits:
Vulnerability discovered by Egidio Romano.
[-] Original Advisory:
https://karmainsecurity.com/KIS-2026-13
[-] Other References:
https://ssd-disclosure.com/vbulletin-runtime-template-runmaths-preauth-rce/
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
10 references
Relationships
reference
GCVE-1988-2026-0287 (this record)
- related CVE-2026-61511
{
"containers": {
"cna": {
"affected": [
{
"product": "vBulletin",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Egidio Romano"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----------------------------------------------------------------\nvBulletin \u003c= 6.2.1 (runMaths) Remote Code Execution Vulnerability\n-----------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://www.vbulletin.com\n\n\n[-] Affected Versions:\n\nVersion 5.7.5 and prior 5.x versions.\nVersion 6.2.1 and prior 6.x versions.\n\n\n[-] Vulnerability Description:\n\nThe vulnerable code is located within the\n/includes/vb5/template/runtime.php script. Specifically, into the\nvB5_Template_Runtime::runMaths() method: the $str parameter is not\nsufficiently sanitized before being used in an eval() call. The regex used\nto validate the input parameter will filter the string only allowing for\ndigits, parentheses, math and binary operators (the XOR, particularly). As\nsuch, this can be exploited to inject and execute (semi) arbitrary PHP code\nthrough \"phpfuck\" techniques. The vulnerability could be exploited by e.g.\nadministrator users, by editing a template/style in the admin panel and\nadding a specially crafted {vb:math} tag (which is a sort of wrapper around\nthe vB5_Template_Runtime::runMaths() method). However, this can also be\nexploited by unauthenticated attackers by abusing the\najax/render/[template] route, rendering a template which uses the {vb:math}\ntag with an user-tainted parameter. One of the possible templates that can\nbe abused that way is the default \"pagenav\" template: here, user input\npassed through the \"pagenav[pagenumber]\" parameter will be assigned to the\n\"pagenav.currentpage\" template variable, which is later used within a\n{vb:math} tag, thus passed to the vB5_Template_Runtime::runMaths() method,\nwhich in turn will pass this string to eval(), eventually resulting in\nexecution of (semi) arbitrary PHP code on the web server.\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/CVE-2026-61511.php\n\n\n[-] Solution:\n\nApply the vendor patch or upgrade to version 6.2.2 or later.\n\n\n[-] Disclosure Timeline:\n\n[25/06/2026] - Vendor was notified by SSD Secure Disclosure\n[30/06/2026] - Vendor released security patch to address this issue:\nhttps://tinyurl.com/vb-patch\n[01/07/2026] - Vendor released version 6.2.2: https://tinyurl.com/vb-622\n[13/07/2026] - CVE identifier requested\n[13/07/2026] - CVE identifier assigned\n[27/07/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nCVE-2026-61511 has been assigned to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-13\n\n\n[-] Other References:\n\nhttps://ssd-disclosure.com/vbulletin-runtime-template-runmaths-preauth-rce/\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T11:40:45Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/29"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/29"
},
{
"url": "https://karmainsecurity.com/KIS-2026-13"
},
{
"url": "https://karmainsecurity.com/pocs/CVE-2026-61511.php"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://ssd-disclosure.com/vbulletin-runtime-template-runmaths-preauth-rce/"
},
{
"url": "https://tinyurl.com/vb-622"
},
{
"url": "https://tinyurl.com/vb-patch"
},
{
"url": "https://www.vbulletin.com"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/29"
],
"discovery": "EXTERNAL"
},
"title": "[KIS-2026-13] vBulletin \u003c= 6.2.1 (runMaths) Remote Code Execution Vulnerability",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-61511",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0287",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/29",
"automated": true,
"contentSha256": "f552a77da0b58d8b73f63dd07d383c31adfeb589892e4c5dc3324e305eb50047",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/29",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-07-27T11:04:04Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0287"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T11:40:45Z",
"dateUpdated": "2026-09-08T11:40:45Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0287"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0038
Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-07 13:20
VLAI
EPSS
VEX
Title
[KIS-2026-13] vBulletin <= 6.2.1 (runMaths) Remote Code Execution Vulnerability
Summary
-----------------------------------------------------------------
vBulletin <= 6.2.1 (runMaths) Remote Code Execution Vulnerability
-----------------------------------------------------------------
[-] Software Link:
https://www.vbulletin.com
[-] Affected Versions:
Version 5.7.5 and prior 5.x versions.
Version 6.2.1 and prior 6.x versions.
[-] Vulnerability Description:
The vulnerable code is located within the
/includes/vb5/template/runtime.php script. Specifically, into the
vB5_Template_Runtime::runMaths() method: the $str parameter is not
sufficiently sanitized before being used in an eval() call. The regex used
to validate the input parameter will filter the string only allowing for
digits, parentheses, math and binary operators (the XOR, particularly). As
such, this can be exploited to inject and execute (semi) arbitrary PHP code
through "phpfuck" techniques. The vulnerability could be exploited by e.g.
administrator users, by editing a template/style in the admin panel and
adding a specially crafted {vb:math} tag (which is a sort of wrapper around
the vB5_Template_Runtime::runMaths() method). However, this can also be
exploited by unauthenticated attackers by abusing the
ajax/render/[template] route, rendering a template which uses the {vb:math}
tag with an user-tainted parameter. One of the possible templates that can
be abused that way is the default "pagenav" template: here, user input
passed through the "pagenav[pagenumber]" parameter will be assigned to the
"pagenav.currentpage" template variable, which is later used within a
{vb:math} tag, thus passed to the vB5_Template_Runtime::runMaths() method,
which in turn will pass this string to eval(), eventually resulting in
execution of (semi) arbitrary PHP code on the web server.
[-] Proof of Concept:
https://karmainsecurity.com/pocs/CVE-2026-61511.php
[-] Solution:
Apply the vendor patch or upgrade to version 6.2.2 or later.
[-] Disclosure Timeline:
[25/06/2026] - Vendor was notified by SSD Secure Disclosure
[30/06/2026] - Vendor released security patch to address this issue:
https://tinyurl.com/vb-patch
[01/07/2026] - Vendor released version 6.2.2: https://tinyurl.com/vb-622
[13/07/2026] - CVE identifier requested
[13/07/2026] - CVE identifier assigned
[27/07/2026] - Public disclosure
[-] CVE Reference:
CVE-2026-61511 has been assigned to this vulnerability.
[-] Credits:
Vulnerability discovered by Egidio Romano.
[-] Original Advisory:
https://karmainsecurity.com/KIS-2026-13
[-] Other References:
https://ssd-disclosure.com/vbulletin-runtime-template-runmaths-preauth-rce/
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
10 references
{
"containers": {
"cna": {
"affected": [
{
"product": "vBulletin",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Egidio Romano"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----------------------------------------------------------------\nvBulletin \u003c= 6.2.1 (runMaths) Remote Code Execution Vulnerability\n-----------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://www.vbulletin.com\n\n\n[-] Affected Versions:\n\nVersion 5.7.5 and prior 5.x versions.\nVersion 6.2.1 and prior 6.x versions.\n\n\n[-] Vulnerability Description:\n\nThe vulnerable code is located within the\n/includes/vb5/template/runtime.php script. Specifically, into the\nvB5_Template_Runtime::runMaths() method: the $str parameter is not\nsufficiently sanitized before being used in an eval() call. The regex used\nto validate the input parameter will filter the string only allowing for\ndigits, parentheses, math and binary operators (the XOR, particularly). As\nsuch, this can be exploited to inject and execute (semi) arbitrary PHP code\nthrough \"phpfuck\" techniques. The vulnerability could be exploited by e.g.\nadministrator users, by editing a template/style in the admin panel and\nadding a specially crafted {vb:math} tag (which is a sort of wrapper around\nthe vB5_Template_Runtime::runMaths() method). However, this can also be\nexploited by unauthenticated attackers by abusing the\najax/render/[template] route, rendering a template which uses the {vb:math}\ntag with an user-tainted parameter. One of the possible templates that can\nbe abused that way is the default \"pagenav\" template: here, user input\npassed through the \"pagenav[pagenumber]\" parameter will be assigned to the\n\"pagenav.currentpage\" template variable, which is later used within a\n{vb:math} tag, thus passed to the vB5_Template_Runtime::runMaths() method,\nwhich in turn will pass this string to eval(), eventually resulting in\nexecution of (semi) arbitrary PHP code on the web server.\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/CVE-2026-61511.php\n\n\n[-] Solution:\n\nApply the vendor patch or upgrade to version 6.2.2 or later.\n\n\n[-] Disclosure Timeline:\n\n[25/06/2026] - Vendor was notified by SSD Secure Disclosure\n[30/06/2026] - Vendor released security patch to address this issue:\nhttps://tinyurl.com/vb-patch\n[01/07/2026] - Vendor released version 6.2.2: https://tinyurl.com/vb-622\n[13/07/2026] - CVE identifier requested\n[13/07/2026] - CVE identifier assigned\n[27/07/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nCVE-2026-61511 has been assigned to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-13\n\n\n[-] Other References:\n\nhttps://ssd-disclosure.com/vbulletin-runtime-template-runmaths-preauth-rce/\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T13:20:21Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/29"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/29"
},
{
"url": "https://karmainsecurity.com/KIS-2026-13"
},
{
"url": "https://karmainsecurity.com/pocs/CVE-2026-61511.php"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://ssd-disclosure.com/vbulletin-runtime-template-runmaths-preauth-rce/"
},
{
"url": "https://tinyurl.com/vb-622"
},
{
"url": "https://tinyurl.com/vb-patch"
},
{
"url": "https://www.vbulletin.com"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/29"
],
"discovery": "EXTERNAL"
},
"title": "[KIS-2026-13] vBulletin \u003c= 6.2.1 (runMaths) Remote Code Execution Vulnerability",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0038",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/29",
"automated": true,
"contentSha256": "f552a77da0b58d8b73f63dd07d383c31adfeb589892e4c5dc3324e305eb50047",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/29",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-07-27T11:04:04Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:21Z",
"dateUpdated": "2026-09-07T13:20:21Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0038"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}