Note: This data is for reference and cybersecurity research purposes only.CyStack advises users not to use this information for unlawful purposes.
CVE-2026-61511 is a vulnerability classified as Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'), affecting vBulletin (affected versions: 5.0.0 – ≤ 5.7.5 and 6.0.0 – ≤ 6.2.1). This vulnerability is rated Critical, with a CVSS score of 9.3. Public exploit code or evidence is available for this vulnerability, but that does not confirm exploitation in the wild.
Analyzing data...
vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenav[pagenumber] parameter. Attackers can exploit the insufficiently restrictive regex filter by using phpfuck-style encoding with permitted characters to inject and execute arbitrary PHP code via the unauthenticated ajax/render template route without any authentication.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
en
