CVE-2026-61511

vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php

vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenav[pagenumber] parameter. Attackers can exploit the insufficiently restrictive regex filter by using phpfuck-style encoding with permitted characters to inject and execute arbitrary PHP code via the unauthenticated ajax/render template route without any authentication.

We have discovered 1,532 live websites that are affected by CVE-2026-61511.

Run a Free Instant Scan



Affected Software

Product  vBulletin
Category Message Boards
Vulnerable Domains1,532 live websites (33% of vBulletin install base)
Vulnerable Versions
  • from 5 through 5.7.5
  • from 6 through 6.2.1
Vulnerable Versions Count47 versions ( 39% of all versions)



Details

  • Published - Jul 27, 2026
  • Updated - Jul 29, 2026

Credits

  • Egidio Romano (finder)

Website Distribution by Country

Number of websites using CVE-2026-61511
United States952 websites


Germany140 websites
France76 websites
GB76 websites
Italy36 websites
Netherlands20 websites
Russia19 websites
Poland16 websites
Spain16 websites
Canada14 websites

Website Distribution by TLD

Number of websites using CVE-2026-61511
.com782 websites
.net132 websites
.eu109 websites
.org107 websites
.de69 websites
.fr51 websites
.co.uk43 websites
.it24 websites
.info16 websites
.nl15 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-61511

Top websites that are affected by CVE-2026-61511. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
********.com United States**,***
******.**********.com United States**,***
******.******.com United States***,***
********.com United States***,***
*****.******.fr France***,***
*****.*********.com United States***,***
*******.de Germany***,***
****.com United States***,***
*******.net United States***,***
********.com United States***,***
See full domain list

FAQ

A total of 1,532 websites have been identified as vulnerable to CVE-2026-61511, based on global website indexing conducted by WebTechSurvey.
The vBulletin is affected by the CVE-2026-61511 vulnerability.
vBulletin versions up to and including 6.2.1 are vulnerable to CVE-2026-61511.