CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-61511 — vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vul...

·Source: NIST NVD

Updated:

Executive Summary

vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenav[pagenumber] parameter. Attackers can exploit the insufficiently restrictive regex filter by using phpfuck-style

Analysis

vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenav[pagenumber] parameter. Attackers can exploit the insufficiently restrictive regex filter by using phpfuck-style encoding with permitted characters to inject and execute arbitrary PHP code via the unauthenticated ajax/render template route without any authentication. CVSS Score: 9.8. Published: 2026-07-27T14:16:59.177.

Indicators of Compromise (1)

CVE (1)
CVE-2026-61511
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 27, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

New York sues Kalshi for 'illegal gambling operation'

New York state has sued Kalshi, alleging that the prediction market is running an "illegal gambling operation".

Finextra
MEDIUMVulnerabilityNEW

The Morning After We Pull a Root of Trust, Nobody Owns It

The most valuable move any security team can make is building a certificate and key inventory.

Dark Reading
MEDIUMVulnerability

Interpol Leverages Global System to Curtail Fraud Payments

When a fraudulent transaction occurs, law enforcement agencies must work quickly to halt payments before cybercriminals cash out.

Dark Reading