CVE-2025-62524: medium-severity vulnerability in THM-Health PILOS
PILOS Exposes PHP version
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.3%
PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. PILOS before 4.8.0 exposes the PHP version via the X-Powered-By header, enabling attackers to fingerprint the server and assess potential exploits. This information disclosure vulnerability originates from PHP’s base image. Additionally, the PHP version can also be inferred through the PILOS version displayed in the footer and by examining the source code available on GitHub. This information disclosure vulnerability has been patched in PILOS in v4.8.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
THM-Health · PILOSRelated CVEs — THM-Health PILOS
In the same product, most dangerous first.
CVE-2023-47107HIGHPILOS account takeover through password reset poisoningEPSS 0.6%CVE-2026-71555MEDIUMPILOS: Reverse tabnabbing in room descriptionEPSS 0.3%CVE-2025-62523MEDIUMPILOS Misconfigured the Access-Control-Allow-Origin HeaderEPSS 0.2%CVE-2025-62781MEDIUMPILOS is missing session regeneration after password changeEPSS 0.2%CVE-2026-22800LOWPILOS affected by a CSRF via GET request allows unintentional termination of all active video conferencesEPSS 0.2%