Public Exploit Reveals Unpatched vBulletin RCE Before Patch Deployment
A public proof‑of‑concept released on July 27 demonstrates an unauthenticated request reaching PHP’s eval() in vBulletin’s template engine, allowing remote code execution on any server running vBulletin 6.2.1 or earlier (and 6.1.6‑). The flaw was patched in vBulletin 6.2.2, but sites still on older versions remain fully exploitable.