CVE-2026-71555: fallo de gravedad media en THM-Health PILOS
PILOS: Reverse tabnabbing in room description
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.1epss 0.3%
PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. From 2.1.0 until 4.14.1, PILOS does not send a Cross-Origin-Opener-Policy response header, so pages opened by PILOS via a link that opens a new browsing context (e.g., target="_blank") retain a window.opener reference back to the originating PILOS tab. A malicious destination page reached this way can use window.opener to navigate or manipulate the original PILOS tab, a technique known as reverse tabnabbing, potentially redirecting an authenticated user to a phishing page that mimics PILOS. This issue is fixed in version 4.14.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
Productos afectados
THM-Health · PILOSCVEs relacionadas — THM-Health PILOS
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-47107HIGHPILOS account takeover through password reset poisoningEPSS 0.6%CVE-2025-62524MEDIUMPILOS Exposes PHP versionEPSS 0.3%CVE-2025-62523MEDIUMPILOS Misconfigured the Access-Control-Allow-Origin HeaderEPSS 0.2%CVE-2025-62781MEDIUMPILOS is missing session regeneration after password changeEPSS 0.2%CVE-2026-22800LOWPILOS affected by a CSRF via GET request allows unintentional termination of all active video conferencesEPSS 0.2%