[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$frCqH_sDFQrE8yG4vSmMO2Pay0itvFT7aFApZKHeXtpQ":3,"g5a-risk:CVE-2026-61511":134},{"success":4,"data":5,"meta":131},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":39,"epssPercentile":29,"epssTimeSeries":40,"severity":42,"affectedProducts":43,"affectedProductsCount":44,"references":45,"referencesCount":69,"weaknesses":70,"weaknessesCount":79,"isActivelyExploited":80,"cisaInfo":29,"otxData":29,"relatedBlogPosts":81,"seoMetadata":82,"configurations":107,"relatedVendorCves":108,"notableEvents":109},"CVE-2026-61511","What is CVE-2026-61511?","vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenav[pagenumber] parameter. Attackers can exploit the insufficiently restrictive regex filter by using phpfuck-style encoding with permitted characters to inject and execute arbitrary PHP code via the unauthenticated ajax\u002Frender template route without any authentication.","vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template...","2026-07-27T14:16:59.177","2026-11-03T23:17:50.57",9.3,"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",{"CVSSMetricV31":15,"CVSSMetricV30":32,"CVSSMetricV2":33,"CVSSMetricV40":34},[16],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":30,"ImpactScore":31},"disclosure@vulncheck.com","Secondary",{"Version":20,"VectorString":21,"AttackVector":22,"AttackComplexity":23,"PrivilegesRequired":24,"UserInteraction":24,"Scope":25,"ConfidentialityImpact":26,"IntegrityImpact":26,"AvailabilityImpact":26,"BaseScore":27,"BaseSeverity":28,"ExploitCodeMaturity":29,"RemediationLevel":29,"ReportConfidence":29,"TemporalScore":29,"TemporalSeverity":29,"ConfidentialityRequirement":29,"IntegrityRequirement":29,"AvailabilityRequirement":29,"ModifiedAttackVector":29,"ModifiedAttackComplexity":29,"ModifiedPrivilegesRequired":29,"ModifiedUserInteraction":29,"ModifiedScope":29,"ModifiedConfidentialityImpact":29,"ModifiedIntegrityImpact":29,"ModifiedAvailabilityImpact":29,"EnvironmentalScore":29,"EnvironmentalSeverity":29},"3.1","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H","NETWORK","LOW","NONE","UNCHANGED","HIGH",9.8,"CRITICAL",null,3.9,5.9,[],[],[35],{"Source":17,"Type":18,"CVSSData":36},{"Version":37,"VectorString":13,"BaseScore":12,"BaseSeverity":28,"AttackVector":22,"AttackComplexity":23,"AttackRequirements":24,"PrivilegesRequired":24,"UserInteraction":24,"VulnConfidentialityImpact":26,"VulnIntegrityImpact":26,"VulnAvailabilityImpact":26,"SubConfidentialityImpact":24,"SubIntegrityImpact":24,"SubAvailabilityImpact":24,"ExploitMaturity":38,"ConfidentialityRequirement":38,"IntegrityRequirement":38,"AvailabilityRequirement":38,"ModifiedAttackVector":38,"ModifiedAttackComplexity":38,"ModifiedAttackRequirements":38,"ModifiedPrivilegesRequired":38,"ModifiedUserInteraction":38,"ModifiedVulnConfidentialityImpact":38,"ModifiedVulnIntegrityImpact":38,"ModifiedVulnAvailabilityImpact":38,"ModifiedSubConfidentialityImpact":38,"ModifiedSubIntegrityImpact":38,"ModifiedSubAvailabilityImpact":38,"Safety":38,"Automatable":38,"Recovery":38,"ValueDensity":38,"VulnerabilityResponseEffort":38,"ProviderUrgency":38},"4.0","NOT_DEFINED",0.74266,[41,41,41,41,41,41,39],0.05607,"Critical",[],0,[46,50,53,57,61,65],{"url":47,"source":48,"tags":49},"https:\u002F\u002Fforum.vbulletin.com\u002Fforum\u002Fvbulletin-announcements\u002Fvbulletin-announcements_aa\u002F4509358-security-patch-released-for-vbulletin-6-2-1-6-2-0-and-6-1-6","Vbulletin",[],{"url":51,"source":48,"tags":52},"https:\u002F\u002Fforum.vbulletin.com\u002Fforum\u002Fvbulletin-announcements\u002Fvbulletin-announcements_aa\u002F4509404-vbulletin-6-2-2-is-available",[],{"url":54,"source":55,"tags":56},"https:\u002F\u002Fkarmainsecurity.com\u002FKIS-2026-13","Karmainsecurity",[],{"url":58,"source":59,"tags":60},"https:\u002F\u002Fssd-disclosure.com\u002Fvbulletin-runtime-template-runmaths-preauth-rce\u002F","Ssd-disclosure",[],{"url":62,"source":63,"tags":64},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fvbulletin-eval-injection-rce-via-vb5-template-runtime-php","Vulncheck",[],{"url":66,"source":67,"tags":68},"http:\u002F\u002Fseclists.org\u002Ffulldisclosure\u002F2026\u002FAug\u002F29","Seclists",[],6,[71],{"id":72,"name":73,"description":74,"extendedDescription":75,"status":76,"abstraction":77,"structure":78},"CWE-95","Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. \"eval\").","This may allow an attacker to execute arbitrary code, or at least modify what code can be executed.","Incomplete","Variant","Simple",1,false,[],{"title":83,"metaDescription":84,"keywords":85,"canonicalUrl":86,"structuredData":87},"What is CVE-2026-61511? Vulnerability Analysis | Security Advisory | EdgeProtect","Comprehensive analysis of CVE-2026-61511, a critical severity cyber security vulnerability from 2026. High exploit probability (74.3%). vBulletin 5.x through...","CVE-2026-61511, CVE-2026-61511 vulnerability, CVE-2026-61511 security, critical severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2026, CVSS score, exploit, patch, remediation, high risk vulnerability, actively exploited, exploit available","\u002Fwhat-is\u002Fcve-2026-61511",{"@context":88,"@type":89,"headline":83,"description":84,"datePublished":10,"dateModified":11,"author":90,"publisher":94,"about":98,"mainEntityOfPage":102,"articleSection":105,"keywords":106},"https:\u002F\u002Fschema.org","TechArticle",{"@type":91,"name":92,"url":93},"Organization","EdgeProtect","https:\u002F\u002Fedgeprotect.io",{"@type":91,"name":92,"url":93,"logo":95},{"@type":96,"url":97},"ImageObject","https:\u002F\u002Fedgeprotect.io\u002Fimg\u002Flogos\u002Fedgeprotect-logo-512.png",{"@type":99,"name":6,"description":100,"additionalType":101},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":103,"@id":104},"WebPage","https:\u002F\u002Fedgeprotect.io\u002Fwhat-is\u002Fcve-2026-61511","Cybersecurity","CVE-2026-61511, CVE-2026-61511 vulnerability, CVE-2026-61511 security, critical severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[],[],[110,117,124],{"id":111,"eventType":112,"eventTime":113,"details":114,"label":115,"color":116},"21722c1a-94cc-4e64-9253-ba0d9b59ebd5","NEW_NVD","2026-07-28T04:01:25.248882+00:00","New CVE added to NVD","Published to NVD","blue",{"id":118,"eventType":119,"eventTime":120,"details":121,"label":122,"color":123},"34eb530c-676c-40a1-9717-fdcd3792d745","HIGH_EPSS_DELTA","2026-08-25T04:04:51.290091+00:00","Daily EPSS score increased by 0.323 on 2026-07-29","EPSS Score Increased","red",{"id":125,"eventType":126,"eventTime":127,"details":128,"label":129,"color":130},"f8ae1f4d-2e27-4c4e-a70f-8c3ab7cac637","LOW_EPSS_DELTA","2026-09-25T04:05:19.234945+00:00","Daily EPSS score decreased by 0.652 on 2026-07-29","EPSS Score Decreased","green",{"lastModified":11,"cacheTime":132,"version":133},1794606972368,"2.0",{"score":135,"band":136,"action":137,"scoredAt":138},71,"High","Patch now","2026-11-13T07:21:06.44839+00:00"]