{"id":65542,"date":"2026-07-31T12:54:35","date_gmt":"2026-07-31T19:54:35","guid":{"rendered":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\/"},"modified":"2026-07-31T12:54:35","modified_gmt":"2026-07-31T19:54:35","slug":"cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per","status":"publish","type":"post","link":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\/","title":{"rendered":"CVE-2026-61511: Pre-Auth Remote Code Execution in vBulletin (runMaths) &#8211; Advisory + Nuclei Detection"},"content":{"rendered":"<p>On July 27, 2026, SSD Secure Disclosure published <strong>CVE-2026-61511<\/strong>, a pre-authentication remote code execution vulnerability in <strong>vBulletin<\/strong>, alongside a working proof-of-concept. The bug is an eval injection in the template engine&#8217;s math handler, and it is about as clean as pre-auth RCE gets: one unauthenticated HTTP POST, no login, no user interaction, no chained bug required. With roughly 45,000 vBulletin instances exposed on the internet, and a public exploit circulating, this is a same-day patch item for anyone still running an affected build.<\/p>\n<p>This advisory is three things at once. First, a plain-English explanation of what CVE-2026-61511 is, which versions are affected, and the version-checking trap that will make a lot of forum admins believe they are patched when they are not. Second, a ready-to-run <strong>Nuclei detection template<\/strong> you can copy, paste, and scan with today &#8211; a non-destructive version and patch-level fingerprint we tested against every boundary case, shipped in <a href=\"\/wordpress\/sn1per-professional-2026\/\">Sn1per<\/a>&#8216;s curated set. Third, a walkthrough of how to find every vBulletin install across an attack surface, including the forgotten ones. Credit where it is due: CVE-2026-61511 was reported by <strong>Egidio Romano<\/strong> (&#8220;EgiX&#8221;) through SSD Secure Disclosure, and published as Karma(In)Security advisory KIS-2026-13.<\/p>\n<h2 id=\"at-a-glance\">CVE-2026-61511 at a glance<\/h2>\n<ul>\n<li><strong>CVE:<\/strong> CVE-2026-61511 &#8211; eval injection (CWE-95) in <code>vB5_Template_Runtime::runMaths()<\/code>.<\/li>\n<li><strong>Impact:<\/strong> unauthenticated remote code execution as the web server user, from a single HTTP POST.<\/li>\n<li><strong>CVSS:<\/strong> 9.8 Critical (<code>CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H<\/code>), and 9.3 Critical under CVSS 4.0. Both scores were assigned by VulnCheck, the CNA.<\/li>\n<li><strong>Affected:<\/strong> vBulletin <strong>5.x through 5.7.5<\/strong> and <strong>6.x through 6.2.1<\/strong>, per the CVE record.<\/li>\n<li><strong>Fixed:<\/strong> vBulletin <strong>6.2.2<\/strong> (released July 1, 2026), or the vendor&#8217;s <strong>Patch Level 1<\/strong> backport for 6.2.1, 6.2.0 and 6.1.6 (released June 30, 2026). <strong>The 5.x branch receives no fix.<\/strong><\/li>\n<li><strong>Status:<\/strong> public proof-of-concept since July 27, 2026. Not in CISA KEV, and no confirmed in-the-wild exploitation at time of writing.<\/li>\n<li><strong>Prerequisite:<\/strong> none. Unlike the 2025 vBulletin template chain, this one has <em>no PHP version requirement<\/em>, so the exploitable population is larger.<\/li>\n<li><strong>Fix now:<\/strong> upgrade to 6.2.2, or apply Patch Level 1. If you are on 5.x, migration is the only remediation.<\/li>\n<\/ul>\n<h2 id=\"what-is-cve-2026-61511\">What is CVE-2026-61511?<\/h2>\n<p>CVE-2026-61511 is an eval injection flaw (CWE-95) in vBulletin&#8217;s template runtime. The vulnerable method is <code>vB5_Template_Runtime::runMaths()<\/code>, which lives in <code>\/includes\/vb5\/template\/runtime.php<\/code> and implements the <code>{vb:math}<\/code> template tag. That tag exists so template authors can do inline arithmetic, and the way vBulletin implements it is to filter the expression with a regular expression and then hand the result to PHP&#8217;s <code>eval()<\/code>.<\/p>\n<p>The filter is the problem. It strips characters outside an allowed set, and the allowed set was drawn to permit legitimate arithmetic: digits, parentheses, and math operators. Letters are removed. On the face of it that looks safe, because you cannot write <code>system<\/code> without letters. But the character class also permits <strong>bitwise operators, including XOR<\/strong>, and that changes everything. In PHP, XOR-ing two strings produces a third string, so an attacker can construct arbitrary text &#8211; including function names &#8211; out of nothing but punctuation and digits. The technique is widely known as &#8220;phpfuck,&#8221; and it turns a letters-are-banned filter into no filter at all. What reaches <code>eval()<\/code> is attacker-chosen PHP.<\/p>\n<p>The second half of the bug is reachability, and this is what makes it pre-auth. vBulletin renders templates over a public AJAX route, <code>ajax\/render\/pagenav<\/code>, which requires no session and no login. The stock <code>pagenav<\/code> template takes the visitor-supplied <code>pagenav[pagenumber]<\/code> request parameter, assigns it to the template variable <code>pagenav.currentpage<\/code>, and folds that variable into a <code>{vb:math}<\/code> tag. So untrusted input travels from an anonymous HTTP request, through the template renderer, into <code>runMaths()<\/code>, through a filter that does not stop it, and into <code>eval()<\/code>. One request, no authentication, arbitrary code execution as the web server user.<\/p>\n<p>It is worth placing this in context, because vBulletin has been here before and the distinction matters for triage. In 2025, CVE-2025-48827 and CVE-2025-48828 chained an authentication bypass with a template-engine RCE. That chain <strong>only worked on PHP 8.1 and above<\/strong>, because its root cause was a behavioral change in <code>ReflectionMethod::invoke()<\/code>. CVE-2026-61511 is a genuinely different bug: different file, different method, different entry route, different root cause, and critically <strong>no PHP version precondition at all<\/strong>. If you convinced yourself last year that an older PHP build protected you, that reasoning does not carry over. This is the third distinct pre-auth code execution issue in vBulletin&#8217;s template system, and it is the broadest of them.<\/p>\n<p>One honest note on sourcing. The vendor advisory scopes the issue to the 6.x branch, while the CVE record from VulnCheck states &#8220;vBulletin 5.x through 5.7.5 and 6.x through 6.2.1.&#8221; We follow the CVE record here, because the vulnerable code lives in the <code>vb5<\/code> template runtime that both branches share, and because the narrower vendor framing tracks which branches are commercially supported rather than which are vulnerable. NVD has marked the record <em>Deferred<\/em>, meaning it will not receive independent NIST enrichment, so the CNA data is the authoritative source and will stay that way.<\/p>\n<h2 id=\"affected-versions\">Affected and fixed versions<\/h2>\n<p>The version picture has an unusual wrinkle that deserves attention before you check anything, because it is the single most likely cause of a false clean bill of health.<\/p>\n<table>\n<thead>\n<tr>\n<th>vBulletin branch<\/th>\n<th>Affected<\/th>\n<th>Fixed<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>6.2.x<\/strong><\/td>\n<td>6.2.0 and 6.2.1<\/td>\n<td>6.2.2, or Patch Level 1 on 6.2.0 \/ 6.2.1<\/td>\n<\/tr>\n<tr>\n<td><strong>6.1.x<\/strong><\/td>\n<td>6.1.6 and earlier<\/td>\n<td>Patch Level 1 on 6.1.6, or upgrade to 6.2.2<\/td>\n<\/tr>\n<tr>\n<td><strong>6.0.x<\/strong><\/td>\n<td>All<\/td>\n<td>Upgrade to 6.2.2<\/td>\n<\/tr>\n<tr>\n<td><strong>5.x<\/strong><\/td>\n<td>All, through 5.7.5<\/td>\n<td><strong>No fix. Migrate to 6.2.2.<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>Here is the trap.<\/strong> On June 30, 2026, vBulletin shipped the fix as a &#8220;Patch Level 1&#8221; security patch for 6.2.1, 6.2.0 and 6.1.6, and <em>a patch level does not change the version number<\/em>. A server running patched 6.2.1 still reports itself as 6.2.1. That means the version string alone cannot tell you whether a 6.x host is safe, and any check that flags purely on &#8220;6.2.1 or below&#8221; will report a false positive against precisely the administrators who took the vendor&#8217;s advice fastest. Conversely, a check that trusts a bare &#8220;6.2.1&#8221; as patched will miss every host that never applied the patch. You need the patch level, not just the version.<\/p>\n<p>The 5.x branch has the opposite property, and it is simpler: there is no patch at any level, so the version number is decisive. Every 5.x install through 5.7.5 is affected and will stay affected. vBulletin&#8217;s own support staff have been explicit that 5.x users need to upgrade rather than wait for a backport.<\/p>\n<h2 id=\"how-it-works\">How the exploit chain works<\/h2>\n<p>The attack is a single unauthenticated POST to the site root, routed internally to the pagenav renderer. The request is unremarkable in shape &#8211; it is the same call the forum makes to render pagination &#8211; and everything hostile lives in one parameter. With the weaponized payload deliberately redacted, the request looks like this:<\/p>\n<pre><code>POST \/ HTTP\/1.1\nHost: forum.example.com\nContent-Type: application\/x-www-form-urlencoded\n\nroutestring=ajax%2Frender%2Fpagenav&amp;pagenav%5Bpagenumber%5D=[NON-ALPHANUMERIC PHP EXPRESSION - REDACTED]<\/code><\/pre>\n<p>The redacted value is a long string of digits, parentheses, dots and XOR operators that carries no letters at all. When <code>runMaths()<\/code> applies its filter, nothing is removed, because every character is on the allowed list. When the filtered string reaches <code>eval()<\/code>, PHP resolves the XOR operations into a function name and its arguments, and calls it. The published proof-of-concept wraps this in an interactive shell that runs arbitrary system commands.<\/p>\n<p><strong>We are deliberately not publishing a working exploit here<\/strong>, and the payload position above is redacted for that reason. The mechanism is described because defenders need to understand what their WAF is looking at, and the request structure is already the published detection guidance. If you need a weaponized copy for authorized validation against your own lab instance, the researcher&#8217;s proof-of-concept is linked from the Karma(In)Security advisory. One practical note if you go that route: the publicly posted script contains a one-character typo, a letter where a digit belongs, so it will not run unmodified. That is the same editorial line we took in our <a href=\"\/wordpress\/cve-2026-50522-sharepoint-rce-detection-with-sn1per\/\">CVE-2026-50522 SharePoint advisory<\/a>.<\/p>\n<h2 id=\"am-i-affected\">Am I affected? Quick manual checks<\/h2>\n<p>The authoritative check is local, and it takes one command. On the forum host, read the version banner out of the shipped JavaScript, which carries both the version <em>and<\/em> the patch level:<\/p>\n<pre><code># On the server, from the vBulletin web root:\nhead -5 js\/login.js\n\n# Look for a line like:\n#   || # vBulletin 6.2.1 Patch Level 1\n# Version alone is not enough on 6.x - you need the \"Patch Level\" token.<\/code><\/pre>\n<p>The admin control panel shows the same information for anyone who prefers a UI: log in to AdminCP and read the version and patch level from the dashboard header.<\/p>\n<p>Remotely, and without authentication, the same <code>\/js\/login.js<\/code> file is the single best signal, because it is the only unauthenticated source that exposes the patch level:<\/p>\n<pre><code>curl -s https:\/\/forum.example.com\/js\/login.js | head -5<\/code><\/pre>\n<p>Two weaker fallbacks exist if that file is blocked. vBulletin 5 and 6 emit a generator tag in the homepage HTML, <code>&lt;meta name=\"generator\" content=\"vBulletin 5.7.5\" \/&gt;<\/code>, and expose an inline JavaScript global, <code>vBulletin.version = '5.7.5'<\/code>. Asset URLs also encode the version as a compact suffix, so a 5.7.5 install requests <code>js\/login.js?v=575<\/code> and <code>js\/header-rollup-575.js<\/code>. That asset pattern is useful because administrators who strip the generator tag rarely rewrite their asset URLs.<\/p>\n<p>Be clear-eyed about what those fallbacks can and cannot tell you. <strong>None of them carries the patch level.<\/strong> On 5.x that does not matter, because no patch exists and the version is decisive. On 6.x it matters entirely: a generator tag reading &#8220;6.2.1&#8221; is genuinely ambiguous, and the only honest verdict from that signal alone is &#8220;needs manual confirmation.&#8221; Treat the absence of a version banner the same way &#8211; a stripped tag means unknown, not clean.<\/p>\n<h2 id=\"nuclei-template\">CVE-2026-61511 Nuclei detection template<\/h2>\n<p>Below is the full template. It is <strong>non-destructive<\/strong>: it performs GET requests for a static JavaScript file, reads the version and patch level from the header comment, and compares them against the affected ranges. It sends no payload, never touches <code>ajax\/render\/pagenav<\/code>, and cannot cause code execution. It is safe to run against production.<\/p>\n<pre><code>id: CVE-2026-61511\n\ninfo:\n  name: vBulletin 5.x \/ 6.x - Pre-Auth Eval Injection RCE (runMaths)\n  author: xer0dayz\n  severity: critical\n  description: |\n    vBulletin is affected by CVE-2026-61511, a pre-authentication remote code\n    execution vulnerability caused by eval injection (CWE-95) in\n    vB5_Template_Runtime::runMaths(). The regex filter preserves the XOR\n    operator, so arbitrary PHP is reconstructible from non-alphabetic\n    characters. The stock pagenav template folds the visitor-supplied\n    pagenav[pagenumber] parameter into a {vb:math} tag, and ajax\/render\/pagenav\n    is reachable without authentication.\n\n    This template is NON-DESTRUCTIVE. It reads the version and patch-level\n    banner from \/js\/login.js and compares against the affected ranges. It sends\n    no payload and does not touch the vulnerable route.\n\n    PATCH-LEVEL CAVEAT: the vendor backported the fix as \"Patch Level 1\" to\n    6.2.1, 6.2.0 and 6.1.6 WITHOUT changing the version number, so a 6.x host\n    cannot be judged on version alone. This template flags 6.x only when the\n    banner carries no \"Patch Level\" token. 5.x has no vendor patch at any\n    level, so 5.x is an unambiguous version comparison.\n  remediation: |\n    Upgrade to vBulletin 6.2.2 or later. On 6.2.1, 6.2.0 or 6.1.6, apply the\n    vendor \"Patch Level 1\" security patch released 2026-06-30. The 5.x branch\n    receives no fix - migrate to a supported 6.x release.\n  reference:\n    - https:\/\/ssd-disclosure.com\/vbulletin-runtime-template-runmaths-preauth-rce\/\n    - https:\/\/karmainsecurity.com\/KIS-2026-13\n    - https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-61511\n    - https:\/\/www.vulncheck.com\/advisories\/vbulletin-eval-injection-rce-via-vb5-template-runtime-php\n  classification:\n    cvss-metrics: CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-61511\n    cwe-id: CWE-95\n  metadata:\n    verified: true\n    max-request: 5\n    vendor: vbulletin\n    product: vbulletin\n    shodan-query: http.html:\"vBulletin.version\"\n  tags: cve,cve2026,vbulletin,rce,eval,unauth,template-injection\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}\/js\/login.js\"\n      - \"{{BaseURL}}\/forum\/js\/login.js\"\n      - \"{{BaseURL}}\/forums\/js\/login.js\"\n      - \"{{BaseURL}}\/board\/js\/login.js\"\n      - \"{{BaseURL}}\/community\/js\/login.js\"\n\n    stop-at-first-match: true\n    redirects: true\n    max-redirects: 2\n\n    matchers-condition: or\n    matchers:\n      - type: dsl\n        name: vbulletin-5x-affected-no-vendor-fix\n        dsl:\n          - \"compare_versions(version, '&gt;= 5.0.0', '&lt;= 5.7.5')\"\n          - \"contains(body, 'vBulletin')\"\n        condition: and\n\n      - type: dsl\n        name: vbulletin-6x-affected-no-patch-level-reported\n        dsl:\n          - \"compare_versions(version, '&gt;= 6.0.0', '&lt;= 6.2.1')\"\n          - \"!contains(body, 'Patch Level')\"\n          - \"contains(body, 'vBulletin')\"\n        condition: and\n\n    extractors:\n      - type: regex\n        name: version\n        part: body\n        group: 1\n        internal: true\n        regex:\n          - 'vBulletins+([0-9]+.[0-9]+.[0-9]+)'\n\n      - type: regex\n        name: vbulletin_build\n        part: body\n        group: 1\n        regex:\n          - 'vBulletins+([0-9]+.[0-9]+.[0-9]+(?:s+Patch Levels+[0-9]+)?)'<\/code><\/pre>\n<p>Save it and run it against a single host or a list:<\/p>\n<pre><code>nuclei -t CVE-2026-61511.yaml -u https:\/\/forum.example.com\/\nnuclei -t CVE-2026-61511.yaml -l vbulletin-hosts.txt<\/code><\/pre>\n<p>A match looks like this, with the extracted build shown so you can triage without a second request:<\/p>\n<pre><code>[CVE-2026-61511:vbulletin-5x-affected-no-vendor-fix] [http] [critical] https:\/\/forum.example.com\/js\/login.js [\"5.7.5 Patch Level 3\"]<\/code><\/pre>\n<p>The matcher name tells you which case fired. A <code>vbulletin-5x-affected-no-vendor-fix<\/code> hit is unambiguous and needs migration planning. A <code>vbulletin-6x-affected-no-patch-level-reported<\/code> hit means the host is on an affected 6.x version and reported no patch level at all, which is the strongest remote signal available that the June 30 patch was never applied.<\/p>\n<p><strong>The two blind spots, stated plainly.<\/strong> First, this is a version-based check, so it inherits the usual limitation: a host that reports a version is telling you what it claims to be running, and a stripped or proxied banner produces silence that means &#8220;unknown, verify manually,&#8221; never &#8220;clean.&#8221; Second, and specific to this CVE: a 6.x host that <em>does<\/em> report a patch level is deliberately not flagged, because the banner says a patch level was applied but not which fix it contained. Those hosts are excluded rather than cleared, and they need confirmation against the vendor&#8217;s patch notes. We would rather under-report than hand you a scan result that quietly marks unpatched forums as safe.<\/p>\n<p>One more thing worth knowing if you are evaluating other detection approaches for this CVE. A tempting idea is to probe the vulnerable route with a harmless arithmetic expression and see whether it evaluates. <strong>That does not work.<\/strong> The <code>{vb:math}<\/code> tag evaluates arithmetic by design, so a benign sum like <code>2-1<\/code> returns the same result on a patched build as on a vulnerable one. The only behavior that actually distinguishes them is whether a <em>function call<\/em> can be reconstructed from non-alphanumeric characters, which means any behavioral check has to send something much closer to a real exploit. That trade-off is exactly why we ship a fingerprint template instead.<\/p>\n<h2 id=\"sn1per\">How to detect CVE-2026-61511 across your attack surface with Sn1per<\/h2>\n<p>A template is only as useful as the target list you feed it, and for vBulletin the target list is the hard part. Forum software is rarely the flagship application. It is the community subdomain someone stood up years ago, the support board attached to a product that shipped in 2019, the acquired company&#8217;s user forum nobody migrated. Those are the hosts that stay unpatched, and they are invisible to a scan that only covers the assets on your inventory spreadsheet. Detection here is a discovery problem before it is a scanning problem, which is the model we cover in <a href=\"\/wordpress\/external-attack-surface-management-with-sn1per\/\">external attack surface management<\/a>.<\/p>\n<p><a href=\"\/wordpress\/sn1per-community-edition\/\">Sn1per<\/a> handles both halves. Run reconnaissance first to enumerate subdomains and live hosts across the domain, then a web scan to fingerprint what is running and apply the curated Nuclei set, including the CVE-2026-61511 template above:<\/p>\n<pre><code>sniper -t example.com -m recon -w acme-forums\nsniper -t example.com -m web   -w acme-forums<\/code><\/pre>\n<p>Everything lands in a workspace, so the discovery pass and the detection pass share one view of the surface. On <a href=\"\/wordpress\/sn1per-professional-2026\/\">Sn1per Professional 2026<\/a> you can pull the findings straight out over the JSON API and route them into a ticket queue or SIEM:<\/p>\n<pre><code>curl -sk -H \"X-API-Key: $SN1PER_API_KEY\" \n  \"https:\/\/sn1per.local\/pro\/api.php?action=vulnerabilities&amp;workspace=acme-forums\" | jq '.'<\/code><\/pre>\n<p>Because the check is a passive fingerprint, it is cheap enough to run continuously rather than as a one-off sweep. That matters more than it sounds: the forums that get compromised are usually not the ones you scanned and found vulnerable, they are the ones that appeared on the surface after your last scan. <a href=\"\/wordpress\/continuous-attack-surface-testing\/\">Continuous attack surface testing<\/a> and <a href=\"\/wordpress\/automated-penetration-testing\/\">automated penetration testing<\/a> both exist to close that gap.<\/p>\n<p>One last point that is specific to this class of work. A complete map of which of your hosts are running unpatched, publicly exploitable software is one of the most sensitive documents your organization will produce. Sn1per is self-hosted across every edition, so that map stays on infrastructure you control rather than in a vendor&#8217;s multi-tenant cloud.<\/p>\n<h2 id=\"editions\">Which Sn1per edition fits<\/h2>\n<table>\n<thead>\n<tr>\n<th>Capability<\/th>\n<th>Community<\/th>\n<th>Professional 2026<\/th>\n<th>Enterprise<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Curated Nuclei set incl. CVE-2026-61511 template<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<\/tr>\n<tr>\n<td>Discovery + detection engine<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<\/tr>\n<tr>\n<td>Scale<\/td>\n<td>Single operator<\/td>\n<td>Up to 150 assets, single operator<\/td>\n<td>Near-unlimited, multi-operator<\/td>\n<\/tr>\n<tr>\n<td>Web UI + scheduled scans<\/td>\n<td>No<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<\/tr>\n<tr>\n<td>JSON API + SIEM \/ ticketing export<\/td>\n<td>No<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<\/tr>\n<tr>\n<td>Multi-workspace \/ multi-team<\/td>\n<td>No<\/td>\n<td>No<\/td>\n<td>Yes<\/td>\n<\/tr>\n<tr>\n<td>Self-hosted \/ on-prem<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><a href=\"\/wordpress\/sn1per-community-edition\/\">Sn1per Community Edition<\/a> is free and open-source and ships the same detection engine, so a spot check across a handful of forum hosts costs nothing. <a href=\"\/wordpress\/sn1per-professional-2026\/\">Sn1per Professional 2026<\/a> adds the web UI, scheduled scans, and the JSON API for teams that want continuous coverage; live pricing is on the <a href=\"\/wordpress\/shop\/\">shop<\/a>. <a href=\"\/wordpress\/sn1per-enterprise\/\">Sn1per Enterprise<\/a> scales to near-unlimited assets with multi-operator, multi-workspace management (custom quote). If you are weighing the two paid tiers, our <a href=\"\/wordpress\/sn1per-professional-vs-sn1per-enterprise-a-comprehensive-comparison\/\">Professional vs Enterprise comparison<\/a> breaks it down.<\/p>\n<h2 id=\"remediation\">Remediation and mitigation<\/h2>\n<p><strong>1. Upgrade to 6.2.2, or apply Patch Level 1. This is the only real fix.<\/strong> vBulletin 6.2.2 shipped July 1, 2026 and contains the fix outright. If a full upgrade is not immediately possible on 6.2.1, 6.2.0 or 6.1.6, apply the vendor&#8217;s Patch Level 1 security patch from June 30. After either action, confirm the running state from <code>js\/login.js<\/code> rather than assuming the deployment landed &#8211; on 6.x you are looking for the &#8220;Patch Level&#8221; token, not just the version.<\/p>\n<p><strong>2. If you are on 5.x, plan the migration now.<\/strong> There is no patch for the 5.x branch and there will not be one. A 5.x forum on the public internet is running a version with a published, working, unauthenticated RCE exploit and no vendor remediation path. If the migration cannot happen this week, take the forum off the public internet or put it behind authentication until it can.<\/p>\n<p><strong>3. Filter the vulnerable route at the edge.<\/strong> As a stopgap only, block or closely inspect unauthenticated POST requests carrying <code>routestring=ajax\/render\/pagenav<\/code> where <code>pagenav[pagenumber]<\/code> is unusually long or dense with operators. A legitimate page number is a small integer, so a value containing XOR operators, long parenthesis runs, or hundreds of characters is not a page number. This reduces risk but is not a substitute for patching, and a determined attacker will work to reshape the payload around a naive rule.<\/p>\n<p><strong>4. Hunt for prior compromise.<\/strong> The patch shipped June 30 and the proof-of-concept went public July 27, so there was a four-week window in which the fix was reverse-engineerable from the patch diff before most administrators had applied it. Search web server access logs for POST requests carrying <code>routestring=ajax\/render\/pagenav<\/code> with abnormal <code>pagenav[pagenumber]<\/code> values, and check for PHP files created or modified under the web root since late June. Because execution happens as the web server user, treat any evidence of exploitation as a full application compromise: rotate database credentials and any API keys readable from the vBulletin configuration, and audit administrator accounts for additions.<\/p>\n<h2 id=\"faq\">Frequently asked questions<\/h2>\n<p><strong>What is CVE-2026-61511?<\/strong> CVE-2026-61511 is a critical, unauthenticated remote code execution vulnerability in vBulletin. It is an eval injection (CWE-95) in the <code>vB5_Template_Runtime::runMaths()<\/code> method, which backs the <code>{vb:math}<\/code> template tag. The method filters input with a regex that permits the XOR operator, then passes the result to PHP&#8217;s <code>eval()<\/code>, so an attacker can reconstruct arbitrary PHP from non-alphabetic characters and execute it through the unauthenticated <code>ajax\/render\/pagenav<\/code> route.<\/p>\n<p><strong>Which vBulletin versions are affected by CVE-2026-61511?<\/strong> vBulletin 5.x through 5.7.5 and 6.x through 6.2.1, according to the CVE record. The fix shipped in vBulletin 6.2.2 on July 1, 2026, and as a Patch Level 1 backport for 6.2.1, 6.2.0 and 6.1.6 on June 30, 2026. The 5.x branch does not receive a patch, so migrating to a supported 6.x release is the only remediation there.<\/p>\n<p><strong>Is CVE-2026-61511 being exploited in the wild?<\/strong> There is no confirmed in-the-wild exploitation at the time of writing, and the CVE is not in the CISA Known Exploited Vulnerabilities catalog. However, a working proof-of-concept has been public since July 27, 2026, and roughly 45,000 vBulletin instances are internet-exposed, so treat public exploitation as likely rather than hypothetical.<\/p>\n<p><strong>How do I check if my vBulletin is patched against CVE-2026-61511?<\/strong> Read the first few lines of <code>js\/login.js<\/code> in the vBulletin web root, which reports both the version and the patch level. On 6.x the patch level is what matters, because the vendor backported the fix without changing the version number, so a host reporting &#8220;6.2.1&#8221; alone is ambiguous while &#8220;6.2.1 Patch Level 1&#8221; is patched. On 5.x the version is decisive, because no patch exists at any level.<\/p>\n<p><strong>Is the CVE-2026-61511 Nuclei template safe to run in production?<\/strong> Yes. The template only performs GET requests for the static <code>\/js\/login.js<\/code> file and compares the reported version and patch level against the affected ranges. It sends no payload, never touches the vulnerable <code>ajax\/render\/pagenav<\/code> route, and cannot trigger code execution. Confirm any hit against the host&#8217;s actual build before scheduling remediation.<\/p>\n<p>CVE-2026-61511 is the kind of vulnerability that punishes forgotten infrastructure more than slow patching. The forums that stay exploitable will not be the ones on a patch calendar &#8211; they will be the community subdomain from an acquisition, the support board attached to a discontinued product, the 5.x install that nobody realized has no upgrade path. Patch what you know about today, then use the template above, or <a href=\"\/wordpress\/sn1per-community-edition\/\">Sn1per<\/a> across your whole surface, to find the vBulletin you forgot.<\/p>\n<p><script type=\"application\/ld+json\">\n{\"@context\":\"https:\/\/schema.org\",\"@type\":\"FAQPage\",\"mainEntity\":[\n{\"@type\":\"Question\",\"name\":\"What is CVE-2026-61511?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"CVE-2026-61511 is a critical, unauthenticated remote code execution vulnerability in vBulletin. It is an eval injection (CWE-95) in the vB5_Template_Runtime::runMaths() method, which backs the {vb:math} template tag. The method filters input with a regex that permits the XOR operator, then passes the result to PHP's eval(), so an attacker can reconstruct arbitrary PHP from non-alphabetic characters and execute it through the unauthenticated ajax\/render\/pagenav route.\"}},\n{\"@type\":\"Question\",\"name\":\"Which vBulletin versions are affected by CVE-2026-61511?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"vBulletin 5.x through 5.7.5 and 6.x through 6.2.1, according to the CVE record. The fix shipped in vBulletin 6.2.2 on July 1, 2026, and as a Patch Level 1 backport for 6.2.1, 6.2.0 and 6.1.6 on June 30, 2026. The 5.x branch does not receive a patch, so migrating to a supported 6.x release is the only remediation there.\"}},\n{\"@type\":\"Question\",\"name\":\"Is CVE-2026-61511 being exploited in the wild?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"There is no confirmed in-the-wild exploitation at the time of writing, and the CVE is not in the CISA Known Exploited Vulnerabilities catalog. However, a working proof-of-concept has been public since July 27, 2026, and roughly 45,000 vBulletin instances are internet-exposed, so treat public exploitation as likely rather than hypothetical.\"}},\n{\"@type\":\"Question\",\"name\":\"How do I check if my vBulletin is patched against CVE-2026-61511?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Read the first few lines of js\/login.js in the vBulletin web root, which reports both the version and the patch level. On 6.x the patch level is what matters, because the vendor backported the fix without changing the version number, so a host reporting 6.2.1 alone is ambiguous while 6.2.1 Patch Level 1 is patched. On 5.x the version is decisive, because no patch exists at any level.\"}},\n{\"@type\":\"Question\",\"name\":\"Is the CVE-2026-61511 Nuclei template safe to run in production?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Yes. The template only performs GET requests for the static \/js\/login.js file and compares the reported version and patch level against the affected ranges. It sends no payload, never touches the vulnerable ajax\/render\/pagenav route, and cannot trigger code execution. Confirm any hit against the host's actual build before scheduling remediation.\"}}\n]}\n<\/script><\/p>\n<div id=\"wp-share-button-65542\" class=\"wp-share-button theme28\"><span class=\"total-share \"><i class=\"total-count-text\">Total Share<\/i> <i class=\"total-count\">0<\/i> <\/span><a target=\"_blank\" href=\"https:\/\/www.facebook.com\/sharer\/sharer.php?u=https:\/\/sn1persecurity.com\/wordpress\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\/\" class=\"share-button share-button-65542 facebook\" id=\"facebook\" data-nonce=\"2379cce913\">\r\n\r\n<span class=\"button-icon\"><\/span>\r\n<span class=\"button-name\">Facebook<\/span>\r\n\r\n<span class=\"button-count\">0<\/span>\r\n\r\n<\/a>\r\n\r\n<a target=\"_blank\" href=\"https:\/\/twitter.com\/intent\/tweet?url=https:\/\/sn1persecurity.com\/wordpress\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\/&amp;text=CVE-2026-61511:%20Pre-Auth%20Remote%20Code%20Execution%20in%20vBulletin%20(runMaths)%20\u2013%20Advisory%20+%20Nuclei%20Detection\" class=\"share-button share-button-65542 twitter\" id=\"twitter\" data-nonce=\"2379cce913\">\r\n\r\n<span class=\"button-icon\"><\/span>\r\n<span class=\"button-name\">Twitter<\/span>\r\n\r\n<span class=\"button-count\">0<\/span>\r\n\r\n<\/a>\r\n\r\n<a target=\"_blank\" href=\"http:\/\/www.reddit.com\/submit?title=CVE-2026-61511:%20Pre-Auth%20Remote%20Code%20Execution%20in%20vBulletin%20(runMaths)%20\u2013%20Advisory%20+%20Nuclei%20Detection&amp;url=https:\/\/sn1persecurity.com\/wordpress\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\/\" class=\"share-button share-button-65542 reddit\" id=\"reddit\" data-nonce=\"2379cce913\">\r\n\r\n<span class=\"button-icon\"><\/span>\r\n<span class=\"button-name\">Reddit<\/span>\r\n\r\n<span class=\"button-count\">0<\/span>\r\n\r\n<\/a>\r\n\r\n<a target=\"_blank\" href=\"https:\/\/www.linkedin.com\/shareArticle?url=https:\/\/sn1persecurity.com\/wordpress\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\/&amp;title=CVE-2026-61511:%20Pre-Auth%20Remote%20Code%20Execution%20in%20vBulletin%20(runMaths)%20\u2013%20Advisory%20+%20Nuclei%20Detection&amp;summary=&amp;source=\" class=\"share-button share-button-65542 linkedin\" id=\"linkedin\" data-nonce=\"2379cce913\">\r\n\r\n<span class=\"button-icon\"><\/span>\r\n<span class=\"button-name\">Linkedin<\/span>\r\n\r\n<span class=\"button-count\">0<\/span>\r\n\r\n<\/a>\r\n\r\n<a title=\"More...\" href=\"#wp-share-button-65542\" class=\"share-button-more\"><span class=\"button-icon\"><i class=\"fa fa-plus\"><\/i><\/span><\/a><div class=\"wp-share-button-popup wp-share-button-popup-65542\"><div class=\"popup-buttons\"><span class=\"close\">X<\/span><a target=\"_blank\" href=\"mailto:?subject=CVE-2026-61511:%20Pre-Auth%20Remote%20Code%20Execution%20in%20vBulletin%20(runMaths)%20\u2013%20Advisory%20+%20Nuclei%20Detection&amp;body=https:\/\/sn1persecurity.com\/wordpress\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\/\" class=\"share-button share-button-65542 email\" id=\"email\">\r\n\r\n<span class=\"button-icon\"><\/span>\r\n<span class=\"button-name\">Email<\/span>\r\n<span class=\"button-count\">0<\/span>\t\t\t\t\r\n\r\n<\/a>\r\n<\/div><\/div><\/div>","protected":false},"excerpt":{"rendered":"<p>CVE-2026-61511 is a critical unauthenticated RCE in vBulletin 5.x and 6.x, caused by eval injection in the runMaths() template handler. A plain-English advisory, a tested non-destructive Nuclei detection template, the 6.x patch-level trap that hides unpatched hosts, and how to find vulnerable vBulletin at scale with Sn1per.<\/p>\n","protected":false},"author":1,"featured_media":65543,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[290,80,99,184,289,338,335],"tags":[359,455,460,462,437,461,459,37,366,436,456,458,457],"class_list":["post-65542","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-attack-surface-management","category-bug-bounties","category-cves","category-news","category-penetration-testing","category-threat-intelligence","category-vulnerability-scanning","tag-359","tag-cve-2026-61511","tag-eval-injection","tag-forum-security","tag-nuclei-template","tag-php-rce","tag-runmaths","tag-sn1per","tag-sn1per-pro","tag-unauthenticated-rce","tag-vbulletin-rce","tag-vbulletin-security","tag-vbulletin-vulnerability"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"CVE-2026-61511: critical unauthenticated RCE in vBulletin 5.x\/6.x via runMaths eval injection. Get the Nuclei detection template and scan with Sn1per.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"xer0dayz\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\/\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Sn1perSecurity\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"CVE-2026-61511: vBulletin Pre-Auth RCE Detection | Sn1per\" \/>\n\t\t<meta property=\"og:description\" content=\"CVE-2026-61511: critical unauthenticated RCE in vBulletin 5.x\/6.x via runMaths eval injection. Get the Nuclei detection template and scan with Sn1per.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/07\/cve-2026-61511-vbulletin.png\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/07\/cve-2026-61511-vbulletin.png\" \/>\n\t\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-07-31T19:54:35+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-07-31T19:54:35+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/Sn1persecurity-105784611869093\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@sn1persecurity\" \/>\n\t\t<meta name=\"twitter:title\" content=\"CVE-2026-61511: vBulletin Pre-Auth RCE Detection | Sn1per\" \/>\n\t\t<meta name=\"twitter:description\" content=\"CVE-2026-61511: critical unauthenticated RCE in vBulletin 5.x\/6.x via runMaths eval injection. Get the Nuclei detection template and scan with Sn1per.\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@sn1persecurity\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/07\/cve-2026-61511-vbulletin.png\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\\\/#blogposting\",\"name\":\"CVE-2026-61511: vBulletin Pre-Auth RCE Detection | Sn1per\",\"headline\":\"CVE-2026-61511: Pre-Auth Remote Code Execution in vBulletin (runMaths) &#8211; Advisory + Nuclei Detection\",\"author\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/author\\\/xer0dayz\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/cve-2026-61511-vbulletin.png\",\"width\":1200,\"height\":630,\"caption\":\"Sn1perSecurity advisory cover: CVE-2026-61511 unauthenticated eval injection RCE in vBulletin runMaths, with a Nuclei detection template and Sn1per attack surface detection\"},\"datePublished\":\"2026-07-31T12:54:35-07:00\",\"dateModified\":\"2026-07-31T12:54:35-07:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\\\/#webpage\"},\"articleSection\":\"Attack Surface Management, Bug Bounties, CVE's, News, Penetration Testing, Threat Intelligence, Vulnerability Scanning, 2026, cve-2026-61511, eval-injection, forum-security, nuclei-template, php-rce, runmaths, sn1per, sn1per pro, unauthenticated-rce, vbulletin-rce, vbulletin-security, vbulletin-vulnerability\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/category\\\/bug-bounties\\\/#listItem\",\"name\":\"Bug Bounties\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/category\\\/bug-bounties\\\/#listItem\",\"position\":2,\"name\":\"Bug Bounties\",\"item\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/category\\\/bug-bounties\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\\\/#listItem\",\"name\":\"CVE-2026-61511: Pre-Auth Remote Code Execution in vBulletin (runMaths) &#8211; Advisory + Nuclei Detection\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\\\/#listItem\",\"position\":3,\"name\":\"CVE-2026-61511: Pre-Auth Remote Code Execution in vBulletin (runMaths) &#8211; Advisory + Nuclei Detection\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/category\\\/bug-bounties\\\/#listItem\",\"name\":\"Bug Bounties\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/#organization\",\"name\":\"Sn1perSecurity\",\"description\":\"Get an attacker's view of your organization with our all-in-one offensive security platform\",\"url\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/\",\"email\":\"support@sn1persecurity.com\",\"foundingDate\":\"2021-10-05\",\"numberOfEmployees\":{\"@type\":\"QuantitativeValue\",\"value\":2},\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/wp-content\\\/uploads\\\/2022\\\/06\\\/Sn1perwhiteandcircleicontwitter.jpg\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\\\/#organizationLogo\",\"width\":500,\"height\":500,\"caption\":\"Sn1perSecurity Logo\"},\"image\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/Sn1persecurity-105784611869093\",\"https:\\\/\\\/x.com\\\/sn1persecurity\",\"https:\\\/\\\/www.instagram.com\\\/sn1persecurity\",\"https:\\\/\\\/www.youtube.com\\\/sn1persecurity\",\"https:\\\/\\\/www.linkedin.com\\\/in\\\/sn1persecurity\\\/\",\"https:\\\/\\\/github.com\\\/1N3\\\/Sn1per\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/author\\\/xer0dayz\\\/#author\",\"url\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/author\\\/xer0dayz\\\/\",\"name\":\"xer0dayz\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/60111840c4f5a576635c5b9169e7322cec38bea67f56f0c141021c7579f230a4?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"xer0dayz\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\\\/#webpage\",\"url\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\\\/\",\"name\":\"CVE-2026-61511: vBulletin Pre-Auth RCE Detection | Sn1per\",\"description\":\"CVE-2026-61511: critical unauthenticated RCE in vBulletin 5.x\\\/6.x via runMaths eval injection. Get the Nuclei detection template and scan with Sn1per.\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/author\\\/xer0dayz\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/author\\\/xer0dayz\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/cve-2026-61511-vbulletin.png\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\\\/#mainImage\",\"width\":1200,\"height\":630,\"caption\":\"Sn1perSecurity advisory cover: CVE-2026-61511 unauthenticated eval injection RCE in vBulletin runMaths, with a Nuclei detection template and Sn1per attack surface detection\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\\\/#mainImage\"},\"datePublished\":\"2026-07-31T12:54:35-07:00\",\"dateModified\":\"2026-07-31T12:54:35-07:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/#website\",\"url\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/\",\"name\":\"Sn1perSecurity\",\"alternateName\":\"Sn1per\",\"description\":\"Get an attacker's view of your organization with our all-in-one offensive security platform\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"CVE-2026-61511: vBulletin Pre-Auth RCE Detection | Sn1per","description":"CVE-2026-61511: critical unauthenticated RCE in vBulletin 5.x\/6.x via runMaths eval injection. Get the Nuclei detection template and scan with Sn1per.","canonical_url":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\/#blogposting","name":"CVE-2026-61511: vBulletin Pre-Auth RCE Detection | Sn1per","headline":"CVE-2026-61511: Pre-Auth Remote Code Execution in vBulletin (runMaths) &#8211; Advisory + Nuclei Detection","author":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/author\/xer0dayz\/#author"},"publisher":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/07\/cve-2026-61511-vbulletin.png","width":1200,"height":630,"caption":"Sn1perSecurity advisory cover: CVE-2026-61511 unauthenticated eval injection RCE in vBulletin runMaths, with a Nuclei detection template and Sn1per attack surface detection"},"datePublished":"2026-07-31T12:54:35-07:00","dateModified":"2026-07-31T12:54:35-07:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\/#webpage"},"isPartOf":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\/#webpage"},"articleSection":"Attack Surface Management, Bug Bounties, CVE's, News, Penetration Testing, Threat Intelligence, Vulnerability Scanning, 2026, cve-2026-61511, eval-injection, forum-security, nuclei-template, php-rce, runmaths, sn1per, sn1per pro, unauthenticated-rce, vbulletin-rce, vbulletin-security, vbulletin-vulnerability"},{"@type":"BreadcrumbList","@id":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/sn1persecurity.com\/wordpress#listItem","position":1,"name":"Home","item":"https:\/\/sn1persecurity.com\/wordpress","nextItem":{"@type":"ListItem","@id":"https:\/\/sn1persecurity.com\/wordpress\/category\/bug-bounties\/#listItem","name":"Bug Bounties"}},{"@type":"ListItem","@id":"https:\/\/sn1persecurity.com\/wordpress\/category\/bug-bounties\/#listItem","position":2,"name":"Bug Bounties","item":"https:\/\/sn1persecurity.com\/wordpress\/category\/bug-bounties\/","nextItem":{"@type":"ListItem","@id":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\/#listItem","name":"CVE-2026-61511: Pre-Auth Remote Code Execution in vBulletin (runMaths) &#8211; Advisory + Nuclei Detection"},"previousItem":{"@type":"ListItem","@id":"https:\/\/sn1persecurity.com\/wordpress#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\/#listItem","position":3,"name":"CVE-2026-61511: Pre-Auth Remote Code Execution in vBulletin (runMaths) &#8211; Advisory + Nuclei Detection","previousItem":{"@type":"ListItem","@id":"https:\/\/sn1persecurity.com\/wordpress\/category\/bug-bounties\/#listItem","name":"Bug Bounties"}}]},{"@type":"Organization","@id":"https:\/\/sn1persecurity.com\/wordpress\/#organization","name":"Sn1perSecurity","description":"Get an attacker's view of your organization with our all-in-one offensive security platform","url":"https:\/\/sn1persecurity.com\/wordpress\/","email":"support@sn1persecurity.com","foundingDate":"2021-10-05","numberOfEmployees":{"@type":"QuantitativeValue","value":2},"logo":{"@type":"ImageObject","url":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/06\/Sn1perwhiteandcircleicontwitter.jpg","@id":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\/#organizationLogo","width":500,"height":500,"caption":"Sn1perSecurity Logo"},"image":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\/#organizationLogo"},"sameAs":["https:\/\/www.facebook.com\/Sn1persecurity-105784611869093","https:\/\/x.com\/sn1persecurity","https:\/\/www.instagram.com\/sn1persecurity","https:\/\/www.youtube.com\/sn1persecurity","https:\/\/www.linkedin.com\/in\/sn1persecurity\/","https:\/\/github.com\/1N3\/Sn1per"]},{"@type":"Person","@id":"https:\/\/sn1persecurity.com\/wordpress\/author\/xer0dayz\/#author","url":"https:\/\/sn1persecurity.com\/wordpress\/author\/xer0dayz\/","name":"xer0dayz","image":{"@type":"ImageObject","@id":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/60111840c4f5a576635c5b9169e7322cec38bea67f56f0c141021c7579f230a4?s=96&d=mm&r=g","width":96,"height":96,"caption":"xer0dayz"}},{"@type":"WebPage","@id":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\/#webpage","url":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\/","name":"CVE-2026-61511: vBulletin Pre-Auth RCE Detection | Sn1per","description":"CVE-2026-61511: critical unauthenticated RCE in vBulletin 5.x\/6.x via runMaths eval injection. Get the Nuclei detection template and scan with Sn1per.","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/#website"},"breadcrumb":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\/#breadcrumblist"},"author":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/author\/xer0dayz\/#author"},"creator":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/author\/xer0dayz\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/07\/cve-2026-61511-vbulletin.png","@id":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\/#mainImage","width":1200,"height":630,"caption":"Sn1perSecurity advisory cover: CVE-2026-61511 unauthenticated eval injection RCE in vBulletin runMaths, with a Nuclei detection template and Sn1per attack surface detection"},"primaryImageOfPage":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\/#mainImage"},"datePublished":"2026-07-31T12:54:35-07:00","dateModified":"2026-07-31T12:54:35-07:00"},{"@type":"WebSite","@id":"https:\/\/sn1persecurity.com\/wordpress\/#website","url":"https:\/\/sn1persecurity.com\/wordpress\/","name":"Sn1perSecurity","alternateName":"Sn1per","description":"Get an attacker's view of your organization with our all-in-one offensive security platform","inLanguage":"en-US","publisher":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/#organization"}}]},"og:locale":"en_US","og:site_name":"Sn1perSecurity","og:type":"article","og:title":"CVE-2026-61511: vBulletin Pre-Auth RCE Detection | Sn1per","og:description":"CVE-2026-61511: critical unauthenticated RCE in vBulletin 5.x\/6.x via runMaths eval injection. Get the Nuclei detection template and scan with Sn1per.","og:url":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\/","og:image":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/07\/cve-2026-61511-vbulletin.png","og:image:secure_url":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/07\/cve-2026-61511-vbulletin.png","og:image:width":"1200","og:image:height":"630","article:published_time":"2026-07-31T19:54:35+00:00","article:modified_time":"2026-07-31T19:54:35+00:00","article:publisher":"https:\/\/www.facebook.com\/Sn1persecurity-105784611869093","twitter:card":"summary_large_image","twitter:site":"@sn1persecurity","twitter:title":"CVE-2026-61511: vBulletin Pre-Auth RCE Detection | Sn1per","twitter:description":"CVE-2026-61511: critical unauthenticated RCE in vBulletin 5.x\/6.x via runMaths eval injection. Get the Nuclei detection template and scan with Sn1per.","twitter:creator":"@sn1persecurity","twitter:image":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/07\/cve-2026-61511-vbulletin.png"},"aioseo_meta_data":{"post_id":"65542","title":"CVE-2026-61511: vBulletin Pre-Auth RCE Detection | Sn1per","description":"CVE-2026-61511: critical unauthenticated RCE in vBulletin 5.x\/6.x via runMaths eval injection. Get the Nuclei detection template and scan with Sn1per.","keywords":null,"keyphrases":{"focus":{"keyphrase":"CVE-2026-61511","score":0,"analysis":[]}},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"featured","og_image_url":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/07\/cve-2026-61511-vbulletin.png","og_image_width":"1200","og_image_height":"630","og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":true,"twitter_card":"summary_large_image","twitter_image_type":"featured","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"BlogPosting","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":true,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":null,"created":"2026-07-31 19:54:40","updated":"2026-07-31 19:55:34","seo_analyzer_scan_date":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/sn1persecurity.com\/wordpress\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/sn1persecurity.com\/wordpress\/category\/bug-bounties\/\" title=\"Bug Bounties\">Bug Bounties<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tCVE-2026-61511: Pre-Auth Remote Code Execution in vBulletin (runMaths) \u2013 Advisory + Nuclei Detection\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/sn1persecurity.com\/wordpress"},{"label":"Bug Bounties","link":"https:\/\/sn1persecurity.com\/wordpress\/category\/bug-bounties\/"},{"label":"CVE-2026-61511: Pre-Auth Remote Code Execution in vBulletin (runMaths) &#8211; Advisory + Nuclei Detection","link":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\/"}],"jetpack_featured_media_url":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/07\/cve-2026-61511-vbulletin.png","jetpack_shortlink":"https:\/\/wp.me\/pdnW96-h38","jetpack_likes_enabled":true,"jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":18544,"url":"https:\/\/sn1persecurity.com\/wordpress\/confluence-rce-ognl-template-injection-cve-2022-26134\/","url_meta":{"origin":65542,"position":0},"title":"Confluence RCE via OGNL template injection (CVE-2022-26134)","author":"xer0dayz","date":"June 5, 2022","format":false,"excerpt":"A critical vulnerability affecting the Atlassian Confluence was disclosed and designated CVE-2022-26134 which allows an un-authenticated attacker to execute arbitrary code on vulnerable servers. A number of Proof-of-Concept (PoC) exploits were published online and exploit activity is actively being observed. Given the impact and severity of the vulnerability, Sn1perSecurity has\u2026","rel":"","context":"In &quot;Attack Surface Management&quot;","block_context":{"text":"Attack Surface Management","link":"https:\/\/sn1persecurity.com\/wordpress\/category\/attack-surface-management\/"},"img":{"alt_text":"Sn1per-CVE-2022-26134-detection1","src":"https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/06\/Sn1per-CVE-2022-26134-detection1.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/06\/Sn1per-CVE-2022-26134-detection1.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/06\/Sn1per-CVE-2022-26134-detection1.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/06\/Sn1per-CVE-2022-26134-detection1.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/06\/Sn1per-CVE-2022-26134-detection1.png?resize=1050%2C600&ssl=1 3x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/06\/Sn1per-CVE-2022-26134-detection1.png?resize=1400%2C800&ssl=1 4x"},"classes":[]},{"id":18193,"url":"https:\/\/sn1persecurity.com\/wordpress\/big-ip-icontrol-rest-rce-cve-2022-1388-detection-with-sn1per-professional\/","url_meta":{"origin":65542,"position":1},"title":"BIG-IP iControl REST RCE (CVE-2022-1388) Detection with Sn1per Professional","author":"xer0dayz","date":"May 10, 2022","format":false,"excerpt":"A critical vulnerability affecting the F5 BIG-IP devices was disclosed and designated CVE-2022-1388 which allows an un-authenticated attacker to execute arbitrary code on vulnerable servers. A number of Proof-of-Concept (PoC) exploits were published online and exploit activity is actively being observed. Given the impact and severity of the vulnerability, Sn1perSecurity\u2026","rel":"","context":"In &quot;Attack Surface Management&quot;","block_context":{"text":"Attack Surface Management","link":"https:\/\/sn1persecurity.com\/wordpress\/category\/attack-surface-management\/"},"img":{"alt_text":"Sn1per-CVE-2022-1388-Scanner1","src":"https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/05\/Sn1per-CVE-2022-1388-Scanner1.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/05\/Sn1per-CVE-2022-1388-Scanner1.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/05\/Sn1per-CVE-2022-1388-Scanner1.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/05\/Sn1per-CVE-2022-1388-Scanner1.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/05\/Sn1per-CVE-2022-1388-Scanner1.png?resize=1050%2C600&ssl=1 3x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/05\/Sn1per-CVE-2022-1388-Scanner1.png?resize=1400%2C800&ssl=1 4x"},"classes":[]},{"id":19102,"url":"https:\/\/sn1persecurity.com\/wordpress\/sn1per-scan-engine-v10-2-update\/","url_meta":{"origin":65542,"position":2},"title":"Sn1per Scan Engine v10.2 Released!","author":"xer0dayz","date":"July 20, 2022","format":false,"excerpt":"Sn1per SE (Scan Engine) v10.2 is now available with a ton of new features and improvements. This update is part of the Sn1per SE development branch which is available to Sn1per Professional v10.0 and Sn1per Enterprise customers. If you are a previous customer (ie. Sn1per Professional v9.0 or less) or\u2026","rel":"","context":"In &quot;News&quot;","block_context":{"text":"News","link":"https:\/\/sn1persecurity.com\/wordpress\/category\/news\/"},"img":{"alt_text":"Sn1per SE v10.2 Update","src":"https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/07\/Sn1per-SE-v10.2-Update.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/07\/Sn1per-SE-v10.2-Update.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/07\/Sn1per-SE-v10.2-Update.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/07\/Sn1per-SE-v10.2-Update.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/07\/Sn1per-SE-v10.2-Update.png?resize=1050%2C600&ssl=1 3x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/07\/Sn1per-SE-v10.2-Update.png?resize=1400%2C800&ssl=1 4x"},"classes":[]},{"id":18011,"url":"https:\/\/sn1persecurity.com\/wordpress\/sn1per-professional-v10-1-se-update-released\/","url_meta":{"origin":65542,"position":3},"title":"Sn1per Professional v10.1 SE Update Released!","author":"xer0dayz","date":"April 19, 2022","format":false,"excerpt":"Sn1per Professional v10.1 Scan Engine (SE) update is now available for Sn1per Professional v10.0 customers with a ton of new features and improvements. This update is part of the Sn1per Professional SE development branch which is exclusively available only to Sn1per Professional v10.0 customers. If you are a previous customer\u2026","rel":"","context":"In &quot;News&quot;","block_context":{"text":"News","link":"https:\/\/sn1persecurity.com\/wordpress\/category\/news\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/04\/Sn1per-Professional-v10.1-Update.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/04\/Sn1per-Professional-v10.1-Update.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/04\/Sn1per-Professional-v10.1-Update.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/04\/Sn1per-Professional-v10.1-Update.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/04\/Sn1per-Professional-v10.1-Update.png?resize=1050%2C600&ssl=1 3x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/04\/Sn1per-Professional-v10.1-Update.png?resize=1400%2C800&ssl=1 4x"},"classes":[]},{"id":21178,"url":"https:\/\/sn1persecurity.com\/wordpress\/sn1per-scan-engine-v10-3-released\/","url_meta":{"origin":65542,"position":4},"title":"Sn1per Scan Engine v10.3 Released!","author":"xer0dayz","date":"January 2, 2023","format":false,"excerpt":"Sn1per SE (Scan Engine) v10.3 is now available with a ton of new features and improvements. This update is part of the Sn1per SE development branch which is available to Sn1per Professional v10.0 and Sn1per Enterprise customers. If you are a previous customer (ie. Sn1per Professional v9.0 or less) or\u2026","rel":"","context":"In &quot;News&quot;","block_context":{"text":"News","link":"https:\/\/sn1persecurity.com\/wordpress\/category\/news\/"},"img":{"alt_text":"Sn1per SE v10.3 Update","src":"https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/12\/Sn1per-SE-v10.3-Update.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/12\/Sn1per-SE-v10.3-Update.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/12\/Sn1per-SE-v10.3-Update.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/12\/Sn1per-SE-v10.3-Update.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/12\/Sn1per-SE-v10.3-Update.png?resize=1050%2C600&ssl=1 3x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/12\/Sn1per-SE-v10.3-Update.png?resize=1400%2C800&ssl=1 4x"},"classes":[]},{"id":26428,"url":"https:\/\/sn1persecurity.com\/wordpress\/sn1per-scan-engine-v10-5-released\/","url_meta":{"origin":65542,"position":5},"title":"Sn1per Scan Engine v10.5 Released!","author":"xer0dayz","date":"January 1, 2024","format":false,"excerpt":"Sn1per SE (Scan Engine) v10.5 is now available with a ton of new features and improvements. This update is part of the Sn1per SE development branch which is available to Sn1per Professional v10.0 and Sn1per Enterprise customers. If you are a previous customer (ie. Sn1per Professional v9.0 or less) or\u2026","rel":"","context":"In &quot;News&quot;","block_context":{"text":"News","link":"https:\/\/sn1persecurity.com\/wordpress\/category\/news\/"},"img":{"alt_text":"Sn1per SE Update","src":"https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2023\/12\/Sn1per-SE-Update.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2023\/12\/Sn1per-SE-Update.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2023\/12\/Sn1per-SE-Update.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2023\/12\/Sn1per-SE-Update.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2023\/12\/Sn1per-SE-Update.png?resize=1050%2C600&ssl=1 3x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2023\/12\/Sn1per-SE-Update.png?resize=1400%2C800&ssl=1 4x"},"classes":[]}],"_links":{"self":[{"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/posts\/65542","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/comments?post=65542"}],"version-history":[{"count":0,"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/posts\/65542\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/media\/65543"}],"wp:attachment":[{"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/media?parent=65542"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/categories?post=65542"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/tags?post=65542"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}