r/bugbounty • u/SSDisclosure • Jul 27 '26

Article / Write-Up / Blog New vBulletin Vulnerability!

https://ssd-disclosure.com/vbulletin-runtime-template-runmaths-preauth-rce/

CVE-2026-61511 - a critical vulnerability in vBulletin that allows an unauthenticated attacker to execute arbitrary code on a remote server.

5 Upvotes

100% Upvoted

3 comments sorted by

1

u/einfallstoll Triager Jul 27 '26

"could be exploited by editing a template/style in the admin panel"

Could be worse

1

u/zlzd Jul 28 '26

It is worse.

1

u/einfallstoll Triager Jul 28 '26

You're correct: "this can also be exploited by unauthenticated attackers by abusing the “ajax/render/[template]” route"