CVE-2025-62524: fallo de gravedad media en THM-Health PILOS
PILOS Exposes PHP version
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.3epss 0.3%
PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. PILOS before 4.8.0 exposes the PHP version via the X-Powered-By header, enabling attackers to fingerprint the server and assess potential exploits. This information disclosure vulnerability originates from PHP’s base image. Additionally, the PHP version can also be inferred through the PILOS version displayed in the footer and by examining the source code available on GitHub. This information disclosure vulnerability has been patched in PILOS in v4.8.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Productos afectados
THM-Health · PILOSCVEs relacionadas — THM-Health PILOS
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-47107HIGHPILOS account takeover through password reset poisoningEPSS 0.6%CVE-2026-71555MEDIUMPILOS: Reverse tabnabbing in room descriptionEPSS 0.3%CVE-2025-62523MEDIUMPILOS Misconfigured the Access-Control-Allow-Origin HeaderEPSS 0.2%CVE-2025-62781MEDIUMPILOS is missing session regeneration after password changeEPSS 0.2%CVE-2026-22800LOWPILOS affected by a CSRF via GET request allows unintentional termination of all active video conferencesEPSS 0.2%