{"metadata": {"vulnerability": "CVE-2025-48827", "count": 83, "kinds": {"milestone": 5, "sighting": 54, "kev": 11, "other": 13}}, "data": [{"timestamp": "2025-05-26T22:00:00Z", "date_only": false, "value": "2025-05-26T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-1148", "record": "WID-SEC-W-2025-1148", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2025-05-26T22:00:00Z", "date_only": false, "value": "2025-05-26T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-1148", "record": "WID-SEC-W-2025-1148", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2025-05-26T22:00:00Z", "date_only": false, "value": "2025-05-26T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-1148", "record": "WID-SEC-W-2025-1148", "field": "vulnerabilities.0.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2025-05-27T00:00:00Z", "date_only": false, "value": "2025-05-27T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-48827", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2025-05-27T00:00:00Z", "date_only": false, "value": "2025-05-27T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2025-48827", "field": "cveMetadata.dateReserved"}, {"timestamp": "2025-05-27T04:15:41Z", "date_only": false, "value": "2025-05-27T04:15:41Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-23FP-MRFV-CWV4", "record": "GHSA-23FP-MRFV-CWV4", "field": "database_specific.nvd_published_at"}, {"timestamp": "2025-05-27T04:15:41.230Z", "date_only": false, "value": "2025-05-27T04:15:41.230", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-48827", "record": "FKIE_CVE-2025-48827", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2025-05-27T04:47:54Z", "date_only": false, "value": "2025-05-27T04:47:54.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/17606", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "d1a93231-57b0-45b8-a1b7-914c8644f470", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-48827\n\ud83d\udd25 CVSS Score: 10 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)\n\ud83d\udd39 Description: vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern.\n\ud83d\udccf Published: 2025-05-27T00:00:00.000Z\n\ud83d\udccf Modified: 2025-05-27T03:55:32.178Z\n\ud83d\udd17 References:\n1. https://karmainsecurity.com/dont-call-that-protected-method-vbulletin-rce", "url": "https://t.me/DarkWebInformer_CVEAlerts/17606", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2025-05-27T05:35:48.496Z", "date_only": false, "value": "2025-05-27T05:35:48.496323Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lq4xrqhgwpy2", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "278f5371-e5b4-4c74-98cc-2f2a3f2d04a4", "url": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lq4xrqhgwpy2"}, {"timestamp": "2025-05-27T06:30:34Z", "date_only": false, "value": "2025-05-27T06:30:34Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-23FP-MRFV-CWV4", "record": "GHSA-23FP-MRFV-CWV4", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2025-05-27T07:01:27.197Z", "date_only": false, "value": "2025-05-27T07:01:27.197543Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lq54l2zaso2s", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "36e78bb6-985b-4cde-8b92-169d86da4b5a", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3lq54l2zaso2s"}, {"timestamp": "2025-05-27T08:10:30Z", "date_only": false, "value": "2025-05-27T08:10:30.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/ptswarm/235", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "09bb682a-81e7-496e-bc9d-ba96274b1f0a", "content": "Don't Call That \"Protected\" Method: Dissecting an N-Day vBulletin RCE\n\n\ud83d\udc64 by Egidio Romano\n\nThe article analyzes a critical Unauthenticated Remote Code Execution vulnerability (CVE-2025-48827) in vBulletin, which becomes exploitable when running on PHP 8.1 or newer.\n\nThe vulnerability stems from vBulletin\u2019s misuse of ReflectionMethod::invoke(), which in PHP 8.1+ no longer blocks access to protected methods by default. As a result, attackers can remotely trigger sensitive internal functions originally meant to be inaccessible and achieve code execution on the server.\n\n\ud83d\udcdd Contents:\n\u25cf The Vulnerability\n\u25cf The vBulletin Vulnerability\n\u25cf Exploiting vBulletin: Path to Pre-Auth RCE\n\u25cf Conclusion\n\nhttps://karmainsecurity.com/dont-call-that-protected-method-vbulletin-rce", "url": "https://t.me/ptswarm/235", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2025-05-27T10:51:39.395Z", "date_only": false, "value": "2025-05-27T10:51:39.395896Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ethicalhack3r.bsky.social/post/3lq5jgmx7rk2v", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "1879032a-b122-4cbb-a531-f3c3e4b144b5", "url": "https://bsky.app/profile/ethicalhack3r.bsky.social/post/3lq5jgmx7rk2v"}, {"timestamp": "2025-05-27T12:48:14.571Z", "date_only": false, "value": "2025-05-27T12:48:14.571Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / mitre", "record": "CVE-2025-48827", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2025-05-27T13:15:45.205Z", "date_only": false, "value": "2025-05-27T13:15:45.205364Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cR0w/statuses/114579979935762719", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "8236b14a-cc38-4ed2-82a8-2b5c5a2e6e3c", "url": "https://infosec.exchange/users/cR0w/statuses/114579979935762719"}, {"timestamp": "2025-05-27T14:05:23.541Z", "date_only": false, "value": "2025-05-27T14:05:23.541754Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-48827", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2025-05-27T14:05:23.541Z", "date_only": false, "value": "2025-05-27T14:05:23.541754Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-48827", "record": "FKIE_CVE-2025-48827", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2025-05-27T18:03:31.961Z", "date_only": false, "value": "2025-05-27T18:03:31.961Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2025-48827", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-05-27T18:03:31.961Z", "date_only": false, "value": "2025-05-27T18:03:31.961Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-48827", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2025-05-27T18:30:49Z", "date_only": false, "value": "2025-05-27T18:30:49Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-23FP-MRFV-CWV4", "record": "GHSA-23FP-MRFV-CWV4", "field": "modified"}, {"timestamp": "2025-05-27T22:05:57.130Z", "date_only": false, "value": "2025-05-27T22:05:57.130297Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/114582064769626809", "record": "cve-2025-48827", "field": "creation_timestamp", "uuid": "8ef91137-d6f9-4576-aba8-28c0b666d0d8", "url": "https://infosec.exchange/users/DarkWebInformer/statuses/114582064769626809"}, {"timestamp": "2025-05-27T22:06:04.019Z", "date_only": false, "value": "2025-05-27T22:06:04.019339Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/darkwebinformer.com/post/3lq6p4mjchs2p", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "9ae795f2-45e7-42cf-ae13-89ba6c9d8244", "url": "https://bsky.app/profile/darkwebinformer.com/post/3lq6p4mjchs2p"}, {"timestamp": "2025-05-27T22:06:24Z", "date_only": false, "value": "2025-05-27T22:06:24.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_News/4899", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "5dacaad6-199a-4c00-8f9c-09eb295553f8", "content": "\ud83d\udea8 News Alert!\n\nSource: Dark Web Informer - Cyber Threat Intelligence\nTitle: CVE-2025-48827 \u2013 Critical Unauthenticated API Access in vBulletin\nLink: https://darkwebinformer.com/cve-2025-48827-critical-unauthenticated-api-access-in-vbulletin/", "url": "https://t.me/DarkWebInformer_News/4899", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2025-05-27T22:09:22Z", "date_only": false, "value": "2025-05-27T22:09:22.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/TheDarkWebInformer/17591", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "da4959d1-ad8d-4d89-b74c-6d1446a81cbf", "content": "\ud83d\udea8CVE-2025-48827 \u2013 Critical Unauthenticated API Access in vBulletin\n\nCVSS: 10\n\nhttps://darkwebinformer.com/cve-2025-48827-critical-unauthenticated-api-access-in-vbulletin/", "url": "https://t.me/TheDarkWebInformer/17591"}, {"timestamp": "2025-05-28T02:19:19.110Z", "date_only": false, "value": "2025-05-28T02:19:19.110701Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3lq75bi67uf2w", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "49aba383-93b0-492c-a03c-317514620084", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3lq75bi67uf2w"}, {"timestamp": "2025-05-30T06:48:17Z", "date_only": false, "value": "2025-05-30T06:48:17.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/proxy_bar/2627", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "d8e2851c-5551-441e-b10c-4b4399d7e932", "content": "CVE-2025-48827\n*\nUnauthenticated API Access in vBulletin\n*\nWriteUP\n*\nPOC", "url": "https://t.me/proxy_bar/2627", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2025-05-30T09:20:24Z", "date_only": false, "value": "2025-05-30T09:20:24.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/zero_day_uz/488", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "9054e404-72cd-4488-ae60-f7087d62cede", "content": "CVE-2025-48827\n*\nUnauthenticated API Access in vBulletin\n*\nWriteUP\n*\nPOC", "url": "https://t.me/zero_day_uz/488", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2025-05-31T07:56:35.458Z", "date_only": false, "value": "2025-05-31T07:56:35.458693Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/earlybirdsinvest.bsky.social/post/3lqhbjdvicu2s", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "230a3b95-3fae-4adc-a68b-143358af7d68", "url": "https://bsky.app/profile/earlybirdsinvest.bsky.social/post/3lqhbjdvicu2s"}, {"timestamp": "2025-05-31T15:27:44Z", "date_only": false, "value": "2025-05-31T15:27:44.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/38781", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "81098e1a-1b36-4af4-8542-9b34cb68dbcf", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2025\n\u63cf\u8ff0\uff1aVbullettin RCE - CVE-2025-48827\nURL\uff1ahttps://github.com/wiseep/CVE-2025-48827\n\n\u6807\u7b7e\uff1a#CVE-2025", "url": "https://t.me/GithubRedTeam/38781", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2025-06-01T12:22:16.411Z", "date_only": false, "value": "2025-06-01T12:22:16.411829Z", "kind": "sighting", "label": "Seen", "source": "https://mstdn.ca/users/rfwaveio/statuses/114608080938242946", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "4a2dd679-7735-4bb7-9a31-21ae131440b2", "url": "https://mstdn.ca/users/rfwaveio/statuses/114608080938242946"}, {"timestamp": "2025-06-01T22:00:00Z", "date_only": false, "value": "2025-06-01T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-1148", "record": "WID-SEC-W-2025-1148", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2025-06-01T22:00:00Z", "date_only": false, "value": "2025-06-01T22:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-1148", "record": "WID-SEC-W-2025-1148", "field": "document.tracking.current_release_date"}, {"timestamp": "2025-06-02T10:18:28.612Z", "date_only": false, "value": "2025-06-02T10:18:28.612358Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/basefortify.bsky.social/post/3lqmkeoptsk2g", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "73afdbaa-7979-4f0d-ba6c-2bacbd67332f", "url": "https://bsky.app/profile/basefortify.bsky.social/post/3lqmkeoptsk2g"}, {"timestamp": "2025-06-02T10:18:29.802Z", "date_only": false, "value": "2025-06-02T10:18:29.802416Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/basefortify.bsky.social/post/3lqmketepi22g", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "7c4f4a34-35a8-495c-bf18-5e6ea3ee86dd", "url": "https://bsky.app/profile/basefortify.bsky.social/post/3lqmketepi22g"}, {"timestamp": "2025-06-02T10:18:30.935Z", "date_only": false, "value": "2025-06-02T10:18:30.935547Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/basefortify.bsky.social/post/3lqmketergk2g", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "798e9ad7-7c01-41ca-9ea0-83d02c0e3bcd", "url": "https://bsky.app/profile/basefortify.bsky.social/post/3lqmketergk2g"}, {"timestamp": "2025-06-02T11:06:31.306Z", "date_only": false, "value": "2025-06-02T11:06:31.306+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-1148", "record": "WID-SEC-W-2025-1148", "field": "document.tracking.generator.date"}, {"timestamp": "2025-06-02T11:56:52.553Z", "date_only": false, "value": "2025-06-02T11:56:52.553929Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/technijian.bsky.social/post/3lqmpurous22c", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "0a1a97c3-4ebf-423f-934c-b5bcbb94dd84", "url": "https://bsky.app/profile/technijian.bsky.social/post/3lqmpurous22c"}, {"timestamp": "2025-06-02T16:29:10.102Z", "date_only": false, "value": "2025-06-02T16:29:10.102704Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3lqn73qasrs2h", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "55130f5e-a2e3-43ab-8465-623fd9c214ab", "url": "https://bsky.app/profile/hacker.at.thenote.app/post/3lqn73qasrs2h"}, {"timestamp": "2025-06-02T17:06:36.479Z", "date_only": false, "value": "2025-06-02T17:06:36.479383Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3lqnb6oj3ha22", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "de1866bb-33da-4c99-80aa-6e0d48d7a68c", "url": "https://bsky.app/profile/securityrss.bsky.social/post/3lqnb6oj3ha22"}, {"timestamp": "2025-06-03T02:20:29.175Z", "date_only": false, "value": "2025-06-03T02:20:29.175885Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3lqoa53q2yt2a", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "f9b66a59-244a-4722-9376-3016bea9fbcc", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3lqoa53q2yt2a"}, {"timestamp": "2025-06-03T14:56:15.975Z", "date_only": false, "value": "2025-06-03T14:56:15.975402Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sansisc.bsky.social/post/3lqpkejj7wl2i", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "45d57e8a-49a3-4140-8e11-42f1f5a838a6", "url": "https://bsky.app/profile/sansisc.bsky.social/post/3lqpkejj7wl2i"}, {"timestamp": "2025-06-03T15:44:30.026Z", "date_only": false, "value": "2025-06-03T15:44:30.026167Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cti-news.bsky.social/post/3lqpn2seoqp2n", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "52e0160d-d4cd-44df-8582-5a6436150c51", "url": "https://bsky.app/profile/cti-news.bsky.social/post/3lqpn2seoqp2n"}, {"timestamp": "2025-06-03T22:31:35.977Z", "date_only": false, "value": "2025-06-03T22:31:35.977321Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cti-news.bsky.social/post/3lqqdsqlpcz2r", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "11b3124b-3976-4748-8aa8-c8a2cd147459", "url": "https://bsky.app/profile/cti-news.bsky.social/post/3lqqdsqlpcz2r"}, {"timestamp": "2025-06-04T00:05:53.403Z", "date_only": false, "value": "2025-06-04T00:05:53.403451Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/114622172462843651", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "eefb9486-6736-4c53-8138-05d197933cce", "url": "https://infosec.exchange/users/DarkWebInformer/statuses/114622172462843651"}, {"timestamp": "2025-06-04T00:05:59Z", "date_only": false, "value": "2025-06-04T00:05:59.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/TheDarkWebInformer/17809", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "0d65f186-8e97-499e-aaf7-6779526ed6aa", "content": "\ud83d\udea8CVE-2025-48827 and CVE-2025-48828: vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3  Remote Code Execution Vulnerabilities\n\nFOFA Link: https://en.fofa.info/result?qbase64=YXBwPSJ2QnVsbGV0aW4i\nFOFA Query: app=\"vBulletin\"\nResults: 26,046\n\nHunter.how Link: https://hunter.how/list?searchValue=product.name%3D%22vBulletin%22&timestamp=1748994874943\nQuery: product.name=\"vBulletin\"\nResults: 22,121\n\nPoC: https://karmainsecurity.com/dont-call-that-protected-method-vbulletin-rce\nAdvisory: https://github.com/advisories/GHSA-23fp-mrfv-cwv4\nCVSS: 10", "url": "https://t.me/TheDarkWebInformer/17809", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2025-06-04T20:18:22.598Z", "date_only": false, "value": "2025-06-04T20:18:22.598580Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3lqsmth5jl22h", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "16d13e94-6fe9-4b92-bb01-08cb1e14d041", "url": "https://bsky.app/profile/hacker.at.thenote.app/post/3lqsmth5jl22h"}, {"timestamp": "2025-06-09T00:23:24.982Z", "date_only": false, "value": "2025-06-09T00:23:24.982401Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3lr54fbkzdw2n", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "9c1c4c89-1740-4020-8e93-adf935d4cdab", "url": "https://bsky.app/profile/undercode.bsky.social/post/3lr54fbkzdw2n"}, {"timestamp": "2025-06-11T03:11:53.278Z", "date_only": false, "value": "2025-06-11T03:11:53.278589Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3lrcgpyg5wk25", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "2c177193-1c77-42d7-87d9-ef9747890d9b", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3lrcgpyg5wk25"}, {"timestamp": "2025-06-11T03:11:54.396Z", "date_only": false, "value": "2025-06-11T03:11:54.396206Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3lrcgq2meys25", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "707c77cf-4501-4d2d-b071-fb06161d8617", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3lrcgq2meys25"}, {"timestamp": "2025-06-11T03:11:55.570Z", "date_only": false, "value": "2025-06-11T03:11:55.570480Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3lrcgq4wg5c25", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "e72da0ca-7962-40a4-9b51-ab21d7971626", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3lrcgq4wg5c25"}, {"timestamp": "2025-06-11T03:11:56.682Z", "date_only": false, "value": "2025-06-11T03:11:56.682717Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3lrcgq6wzjk25", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "53074f15-bd38-4117-8e29-a5bb34debc35", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3lrcgq6wzjk25"}, {"timestamp": "2025-06-11T03:11:57.762Z", "date_only": false, "value": "2025-06-11T03:11:57.762292Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3lrcgqaesek25", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "3ccf3344-461a-4557-8f8d-5176b41b5263", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3lrcgqaesek25"}, {"timestamp": "2025-06-11T03:13:12.430Z", "date_only": false, "value": "2025-06-11T03:13:12.430595Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3lrcgsobzl225", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "636e0135-469f-43e4-b01c-1ddfb807165f", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3lrcgsobzl225"}, {"timestamp": "2025-06-29T14:45:21Z", "date_only": false, "value": "2025-06-29T14:45:21.000000Z", "kind": "sighting", "label": "Seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/vbulletin_replace_ad_template_rce.rb", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "eb88af17-977f-4e02-b64e-e19d4c316c2b", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/vbulletin_replace_ad_template_rce.rb"}, {"timestamp": "2025-06-30T21:02:24.883Z", "date_only": false, "value": "2025-06-30T21:02:24.883933Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lsu3g26nic27", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "828590f3-a791-4b4d-a448-b75116d5967d", "url": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lsu3g26nic27"}, {"timestamp": "2025-07-10T21:02:27.622Z", "date_only": false, "value": "2025-07-10T21:02:27.622488Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3ltna3dk5fv2r", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "828543f9-29e9-4e3c-90f8-9cbae59588d4", "url": "https://bsky.app/profile/beikokucyber.bsky.social/post/3ltna3dk5fv2r"}, {"timestamp": "2025-07-14T02:21:41Z", "date_only": false, "value": "2025-07-14T02:21:41.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/43957", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "46bf72df-3d88-4a1a-a7fa-a857da070c79", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2025\n\u63cf\u8ff0\uff1aThis PoC for CVE-2025-48799 demonstrates an elevation of privilege vulnerability in Windows Update service, affecting Windows 10 and 11. \ud83d\udc31\ud83d\udcbb\ud83d\udd12\nURL\uff1ahttps://github.com/SystemVll/CVE-2025-48827\n\n\u6807\u7b7e\uff1a#CVE-2025", "url": "https://t.me/GithubRedTeam/43957", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2025-07-14T09:00:05Z", "date_only": false, "value": "2025-07-14T09:00:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/jMiaAfR2J9C34xHnElOO8QMQNpsrJcxgBx1v7Waf8IgPpW8", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "c0dfe9c8-8dce-4abf-b20e-d00caa75b91d", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2025-07-31T00:00:00Z", "date_only": true, "value": "2025-07-31", "kind": "kev", "label": "Observation date", "source": "shadowserver", "record": "CVE-2025-48827", "field": "evidence.0.details.observation_date", "uuid": "af6742f3-be63-4f44-8b19-a63c5c0195a9", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-07-31T11:19:50Z", "date_only": false, "value": "2025-07-31T11:19:50+00:00", "kind": "kev", "label": "Asserted", "source": "shadowserver", "record": "CVE-2025-48827", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "af6742f3-be63-4f44-8b19-a63c5c0195a9", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-07-31T11:19:50Z", "date_only": false, "value": "2025-07-31T11:19:50+00:00", "kind": "kev", "label": "First seen", "source": "shadowserver", "record": "CVE-2025-48827", "field": "timestamps.first_seen_at", "metric_role": "exploitation", "metric_basis": "kev_first_seen", "uuid": "af6742f3-be63-4f44-8b19-a63c5c0195a9", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-07-31T11:19:50Z", "date_only": false, "value": "2025-07-31T11:19:50+00:00", "kind": "kev", "label": "Last seen", "source": "shadowserver", "record": "CVE-2025-48827", "field": "timestamps.last_seen_at", "uuid": "af6742f3-be63-4f44-8b19-a63c5c0195a9", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-07-31T11:19:50Z", "date_only": false, "value": "2025-07-31T11:19:50+00:00", "kind": "kev", "label": "Status updated", "source": "shadowserver", "record": "CVE-2025-48827", "field": "status.status_updated_at", "uuid": "af6742f3-be63-4f44-8b19-a63c5c0195a9", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-08-18T12:48:58Z", "date_only": false, "value": "2025-08-18T12:48:58.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/mmnQPxYPad0BrjaBHJXSSYW2LO_z99I-C23b4HJ_CoEZX7k", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "0802074b-9540-4b30-b210-f17a3ae9eef9"}, {"timestamp": "2025-08-18T12:54:19Z", "date_only": false, "value": "2025-08-18T12:54:19.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/XQKe4bT8FK3F10HvEfMlSoaiSPO11uwAyXAnHNKdVDXw5jE", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "53d58689-1368-469f-ab0e-c2a1cdd1fff6", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2025-08-18T12:59:14Z", "date_only": false, "value": "2025-08-18T12:59:14.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/mXhAenI_vLH8nQPjWxD-CnH6g8SvVJ_iPGubky7Y2eMMMl4", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "e9972db6-76fa-426b-88a6-68dfbf1d3f77", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2025-08-18T13:10:46Z", "date_only": false, "value": "2025-08-18T13:10:46.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/sadvUUXk3aTJVcJ8qZrZxZApNI6-HF3gp0Ocq_7F61MqSRM", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "fb307bc1-9ddf-463a-a811-fce9057e646c", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2025-08-19T08:34:17Z", "date_only": false, "value": "2025-08-19T08:34:17.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/mYbO-btv1Z80MBtHpzwHFlPawz1QWxIri8XzoqoOpRHlRYw", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "060de1ab-2661-403e-a8e3-b09ccfb0204e", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2025-09-09T20:51:39Z", "date_only": false, "value": "2025-09-09T20:51:39.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/e0a0042d-e47b-4875-b781-99d4428af3c2", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "2373c9e9-7a83-4ee9-bb8b-3f697bd08afc"}, {"timestamp": "2025-09-23T14:21:51Z", "date_only": false, "value": "2025-09-23T14:21:51.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/Darkcrai86/09ba83d6f51a7709569fdf648ea3de18", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "8daaabe9-5ade-40d5-8561-b782beb96efb", "url": "https://gist.github.com/Darkcrai86/09ba83d6f51a7709569fdf648ea3de18"}, {"timestamp": "2025-10-23T21:13:04Z", "date_only": false, "value": "2025-10-23T21:13:04.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "24b5e88d-1918-4c3c-bb6b-7d2a2f388d09"}, {"timestamp": "2026-06-03T10:06:54Z", "date_only": false, "value": "2026-06-03T10:06:54+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2025-48827", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "16d4b1e6-0f2d-4641-8c9c-577951135e7b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-03T10:06:54Z", "date_only": false, "value": "2026-06-03T10:06:54+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2025-48827", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "16d4b1e6-0f2d-4641-8c9c-577951135e7b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-03T10:06:54Z", "date_only": false, "value": "2026-06-03T10:06:54+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2025-48827", "field": "status.status_updated_at", "uuid": "16d4b1e6-0f2d-4641-8c9c-577951135e7b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-03T10:06:54.268Z", "date_only": false, "value": "2026-06-03T10:06:54.268Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2025-48827", "field": "evidence.0.details.added_date", "uuid": "16d4b1e6-0f2d-4641-8c9c-577951135e7b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-17T09:30:23.407Z", "date_only": false, "value": "2026-06-17T09:30:23.407", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-48827", "record": "FKIE_CVE-2025-48827", "field": "lastModified"}, {"timestamp": "2026-06-19T12:45:10.804Z", "date_only": false, "value": "2026-06-19T12:45:10.804715Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/4c695edc-f33a-4625-8ea6-c11328201274", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "258757ab-309d-432a-8672-fd532963d303", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/4c695edc-f33a-4625-8ea6-c11328201274", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-06-23T14:02:37Z", "date_only": false, "value": "2026-06-23T14:02:37+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2025-48827", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "16d4b1e6-0f2d-4641-8c9c-577951135e7b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-23T14:03:02.367Z", "date_only": false, "value": "2026-06-23T14:03:02.367857Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/16d4b1e6-0f2d-4641-8c9c-577951135e7b", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "9896ee93-235e-4b46-99a1-9b88f297ef5d", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/16d4b1e6-0f2d-4641-8c9c-577951135e7b", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-06-30T11:20:47Z", "date_only": false, "value": "2026-06-30T11:20:47+00:00", "kind": "kev", "label": "Recorded", "source": "shadowserver", "record": "CVE-2025-48827", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "af6742f3-be63-4f44-8b19-a63c5c0195a9", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-30T11:39:55.597Z", "date_only": false, "value": "2026-06-30T11:39:55.597395Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/af6742f3-be63-4f44-8b19-a63c5c0195a9", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "86e6200a-15e5-4573-9969-825d8fea4526", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/af6742f3-be63-4f44-8b19-a63c5c0195a9", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-14T16:00:12.503Z", "date_only": false, "value": "2026-08-14T16:00:12.503031Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/purp_sec/712", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "fac3038c-84ae-45b5-9348-397f91f90f0c", "content": "\ud83d\udd12 \u0425\u0430\u043a\u0435\u0440\u044b \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 open-source \u041f\u041e \u0434\u043b\u044f \u0444\u043e\u0440\u0443\u043c\u043e\u0432 vBulletin\n\n\u0411\u0430\u0433\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u042d\u0434\u0436\u0438\u0434\u0438\u043e \u0420\u043e\u043c\u0430\u043d\u043e (EgiX).\n\nCVE-2025-48827 \u2014 \u0432 \u0441\u0432\u043e\u0435\u043c \u043e\u0442\u0447\u0435\u0442\u0435 EgiX \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442, \u0447\u0442\u043e \u0432 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 PHP 8.1 \u0438 \u0432\u044b\u0448\u0435 \u0438\u0437\u043c\u0435\u043d\u0438\u043b\u043e\u0441\u044c \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u043c\u0435\u0442\u043e\u0434\u0430 ReflectionMethod::invoke(), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0442\u0435\u043f\u0435\u0440\u044c \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u0435\u0442 \u0432\u044b\u0437\u044b\u0432\u0430\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0435 \u0438 \u0434\u0430\u0436\u0435 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0431\u0435\u0437 \u044f\u0432\u043d\u043e\u0433\u043e \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0438\u0445 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u0438 \u0447\u0435\u0440\u0435\u0437 setAccessible(true). \u0412 vBulletin \u043c\u0435\u0442\u043e\u0434 API \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0438 \u0431\u0435\u0437 \u0441\u0442\u0440\u043e\u0433\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0435\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u0438, \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u0447\u0435\u043c\u0443 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e \u0432\u044b\u0437\u044b\u0432\u0430\u0442\u044c vB_Api_Ad::replaceAdTemplate() \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0434\u043b\u044f \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f, \u043f\u043e\u0441\u043b\u0435 \u0447\u0435\u0433\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434.\n\nCVE-2025-48828 \u2014 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 PHP-\u043a\u043e\u0434 \u0447\u0435\u0440\u0435\u0437 \u0443\u0441\u043b\u043e\u0432\u043d\u044b\u0435 \u043a\u043e\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0438 \u0432 \u0448\u0430\u0431\u043b\u043e\u043d\u0438\u0437\u0430\u0442\u043e\u0440\u0435 \u0434\u0432\u0438\u0436\u043a\u0430. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0430\u043b\u044c\u0442\u0435\u0440\u043d\u0430\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0441\u0438\u043d\u0442\u0430\u043a\u0441\u0438\u0441\u0430 \u0432\u044b\u0437\u043e\u0432\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u0439, \u0442\u0430\u043a\u043e\u0433\u043e \u043a\u0430\u043a (\"var_dump\")(\"test\"), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0431\u043e\u0439\u0442\u0438 \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n\n\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c vBulletin \u0434\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 \u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0436\u0443\u0440\u043d\u0430\u043b\u044b \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u043d\u0430 \u043f\u0440\u0435\u0434\u043c\u0435\u0442 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432.\n\n\ud83d\udd17 \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.\n\n#blue_team #opensource #CVE", "url": "https://t.me/purp_sec/712"}, {"timestamp": "2026-08-15T00:00:08.051Z", "date_only": false, "value": "2026-08-15T00:00:08.051550Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/purp_sec/712", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "8f4dd162-6bf4-4941-9553-f48b4175d1e9", "content": "\ud83d\udd12 \u0425\u0430\u043a\u0435\u0440\u044b \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 open-source \u041f\u041e \u0434\u043b\u044f \u0444\u043e\u0440\u0443\u043c\u043e\u0432 vBulletin\n\n\u0411\u0430\u0433\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u042d\u0434\u0436\u0438\u0434\u0438\u043e \u0420\u043e\u043c\u0430\u043d\u043e (EgiX).\n\nCVE-2025-48827 \u2014 \u0432 \u0441\u0432\u043e\u0435\u043c \u043e\u0442\u0447\u0435\u0442\u0435 EgiX \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442, \u0447\u0442\u043e \u0432 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 PHP 8.1 \u0438 \u0432\u044b\u0448\u0435 \u0438\u0437\u043c\u0435\u043d\u0438\u043b\u043e\u0441\u044c \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u043c\u0435\u0442\u043e\u0434\u0430 ReflectionMethod::invoke(), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0442\u0435\u043f\u0435\u0440\u044c \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u0435\u0442 \u0432\u044b\u0437\u044b\u0432\u0430\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0435 \u0438 \u0434\u0430\u0436\u0435 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0431\u0435\u0437 \u044f\u0432\u043d\u043e\u0433\u043e \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0438\u0445 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u0438 \u0447\u0435\u0440\u0435\u0437 setAccessible(true). \u0412 vBulletin \u043c\u0435\u0442\u043e\u0434 API \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0438 \u0431\u0435\u0437 \u0441\u0442\u0440\u043e\u0433\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0435\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u0438, \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u0447\u0435\u043c\u0443 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e \u0432\u044b\u0437\u044b\u0432\u0430\u0442\u044c vB_Api_Ad::replaceAdTemplate() \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0434\u043b\u044f \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f, \u043f\u043e\u0441\u043b\u0435 \u0447\u0435\u0433\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434.\n\nCVE-2025-48828 \u2014 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 PHP-\u043a\u043e\u0434 \u0447\u0435\u0440\u0435\u0437 \u0443\u0441\u043b\u043e\u0432\u043d\u044b\u0435 \u043a\u043e\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0438 \u0432 \u0448\u0430\u0431\u043b\u043e\u043d\u0438\u0437\u0430\u0442\u043e\u0440\u0435 \u0434\u0432\u0438\u0436\u043a\u0430. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0430\u043b\u044c\u0442\u0435\u0440\u043d\u0430\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0441\u0438\u043d\u0442\u0430\u043a\u0441\u0438\u0441\u0430 \u0432\u044b\u0437\u043e\u0432\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u0439, \u0442\u0430\u043a\u043e\u0433\u043e \u043a\u0430\u043a (\"var_dump\")(\"test\"), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0431\u043e\u0439\u0442\u0438 \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430.\n\n\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c vBulletin \u0434\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 \u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0436\u0443\u0440\u043d\u0430\u043b\u044b \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u043d\u0430 \u043f\u0440\u0435\u0434\u043c\u0435\u0442 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432.\n\n\ud83d\udd17 \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.\n\n#blue_team #opensource #CVE", "url": "https://t.me/purp_sec/712", "metric_role": "exploitation", "metric_basis": "sighting_report"}], "metrics": {"as_of": "2026-10-28T13:59:16.298Z", "anchors": {"origin": {"timestamp": "2025-05-26T22:00:00Z", "date_only": false, "value": "2025-05-26T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-1148", "record": "WID-SEC-W-2025-1148", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2025-05-26T22:00:00Z", "date_only": false, "value": "2025-05-26T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-1148", "record": "WID-SEC-W-2025-1148", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2025-05-27T04:47:54Z", "date_only": false, "value": "2025-05-27T04:47:54.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/17606", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "d1a93231-57b0-45b8-a1b7-914c8644f470", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-48827\n\ud83d\udd25 CVSS Score: 10 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)\n\ud83d\udd39 Description: vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern.\n\ud83d\udccf Published: 2025-05-27T00:00:00.000Z\n\ud83d\udccf Modified: 2025-05-27T03:55:32.178Z\n\ud83d\udd17 References:\n1. https://karmainsecurity.com/dont-call-that-protected-method-vbulletin-rce", "url": "https://t.me/DarkWebInformer_CVEAlerts/17606", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": {"timestamp": "2025-07-31T11:19:50Z", "date_only": false, "value": "2025-07-31T11:19:50+00:00", "kind": "kev", "label": "First seen", "source": "shadowserver", "record": "CVE-2025-48827", "field": "timestamps.first_seen_at", "metric_role": "exploitation", "metric_basis": "kev_first_seen", "uuid": "af6742f3-be63-4f44-8b19-a63c5c0195a9", "status": {"status_reason": "confirmed", "exploited": true}}, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": true, "seconds": 5663990.0, "hours": 1573.3305555555555, "days": 65.55543981481482, "min_seconds": 5663990.0, "max_seconds": 5663990.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-05-26T22:00:00Z", "date_only": false, "value": "2025-05-26T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-1148", "record": "WID-SEC-W-2025-1148", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2025-07-31T11:19:50Z", "date_only": false, "value": "2025-07-31T11:19:50+00:00", "kind": "kev", "label": "First seen", "source": "shadowserver", "record": "CVE-2025-48827", "field": "timestamps.first_seen_at", "metric_role": "exploitation", "metric_basis": "kev_first_seen", "uuid": "af6742f3-be63-4f44-8b19-a63c5c0195a9", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit": {"available": true, "seconds": 5663990.0, "hours": 1573.3305555555555, "days": 65.55543981481482, "min_seconds": 5663990.0, "max_seconds": 5663990.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-05-26T22:00:00Z", "date_only": false, "value": "2025-05-26T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-1148", "record": "WID-SEC-W-2025-1148", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2025-07-31T11:19:50Z", "date_only": false, "value": "2025-07-31T11:19:50+00:00", "kind": "kev", "label": "First seen", "source": "shadowserver", "record": "CVE-2025-48827", "field": "timestamps.first_seen_at", "metric_role": "exploitation", "metric_basis": "kev_first_seen", "uuid": "af6742f3-be63-4f44-8b19-a63c5c0195a9", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit_publication": {"available": true, "seconds": 24474.0, "hours": 6.798333333333333, "days": 0.28326388888888887, "min_seconds": 24474.0, "max_seconds": 24474.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-05-26T22:00:00Z", "date_only": false, "value": "2025-05-26T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-1148", "record": "WID-SEC-W-2025-1148", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2025-05-27T04:47:54Z", "date_only": false, "value": "2025-05-27T04:47:54.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/17606", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "d1a93231-57b0-45b8-a1b7-914c8644f470", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-48827\n\ud83d\udd25 CVSS Score: 10 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)\n\ud83d\udd39 Description: vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern.\n\ud83d\udccf Published: 2025-05-27T00:00:00.000Z\n\ud83d\udccf Modified: 2025-05-27T03:55:32.178Z\n\ud83d\udd17 References:\n1. https://karmainsecurity.com/dont-call-that-protected-method-vbulletin-rce", "url": "https://t.me/DarkWebInformer_CVEAlerts/17606", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 44899156.298774, "hours": 12471.987860770554, "days": 519.6661608654398, "min_seconds": 44899156.298774, "max_seconds": 44899156.298774, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-05-26T22:00:00Z", "date_only": false, "value": "2025-05-26T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2025-1148", "record": "WID-SEC-W-2025-1148", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-28T13:59:16.298Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": true, "seconds": 39235166.298774, "hours": 10898.657305215, "days": 454.11072105062493, "min_seconds": 39235166.298774, "max_seconds": 39235166.298774, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-07-31T11:19:50Z", "date_only": false, "value": "2025-07-31T11:19:50+00:00", "kind": "kev", "label": "First seen", "source": "shadowserver", "record": "CVE-2025-48827", "field": "timestamps.first_seen_at", "metric_role": "exploitation", "metric_basis": "kev_first_seen", "uuid": "af6742f3-be63-4f44-8b19-a63c5c0195a9", "status": {"status_reason": "confirmed", "exploited": true}}, "end": {"timestamp": "2026-10-28T13:59:16.298Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploit_publication_to_patch": {"available": true, "seconds": 44874682.298774, "hours": 12465.189527437222, "days": 519.3828969765509, "min_seconds": 44874682.298774, "max_seconds": 44874682.298774, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-05-27T04:47:54Z", "date_only": false, "value": "2025-05-27T04:47:54.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/17606", "record": "CVE-2025-48827", "field": "creation_timestamp", "uuid": "d1a93231-57b0-45b8-a1b7-914c8644f470", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-48827\n\ud83d\udd25 CVSS Score: 10 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)\n\ud83d\udd39 Description: vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern.\n\ud83d\udccf Published: 2025-05-27T00:00:00.000Z\n\ud83d\udccf Modified: 2025-05-27T03:55:32.178Z\n\ud83d\udd17 References:\n1. https://karmainsecurity.com/dont-call-that-protected-method-vbulletin-rce", "url": "https://t.me/DarkWebInformer_CVEAlerts/17606", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-10-28T13:59:16.298Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}