VulnerabilityDeferred

CVE-2026-61511

CRITICAL 9.3EPSS 5.61%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (5.61%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenav[pagenumber] parameter. Attackers can exploit the insufficiently restrictive regex filter by using phpfuck-style encoding with permitted characters to inject and execute arbitrary PHP code via the unauthenticated ajax/render template route without any authentication.

CVSS 4.0: 9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 5.61% probability · 93th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-95
Source: disclosure@vulncheck.com

EPSS trend

EPSS moved from 5.6% on 24 September 2026 to 5.6% on 26 October 2026. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”.

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.