1name: crowdsecurity/vpatch-CVE-2026-61511
2description: 'Detects vBulletin runtime template runMaths pre-auth RCE via crafted pagenav[pagenumber] routed through routestring=ajax/render/pagenav.'
3rules:
4  - and:
5      - zones:
6          - BODY_ARGS
7        variables:
8          - routestring
9        transform:
10          - urldecode
11          - lowercase
12        match:
13          type: contains
14          value: 'ajax/render/pagenav'
15      - zones:
16          - BODY_ARGS
17        variables:
18          - pagenav[pagenumber]
19        transform:
20          - urldecode
21          - lowercase
22        match:
23          type: contains
24          value: '('
25
26labels:
27  type: exploit
28  service: http
29  confidence: 3
30  spoofable: 0
31  behavior: 'http:exploit'
32  label: 'vBulletin - RCE'
33  classification:
34    - cve.CVE-2026-61511
35    - attack.T1190
36    - cwe.CWE-95
37