CVE-2025-62524CWE-200CWE-497information-disclosure

CVE-2025-62524

Medium · published October 28, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
16.9
In the wild
Unconfirmed
What it is

PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. PILOS before 4.8.0 exposes the PHP version via the X-Powered-By header, enabling attackers to fingerprint the server and assess potential exploits. This information disclosure vulnerability originates from PHP’s base image. Additionally, the PHP version can also be inferred through the PILOS version displayed in the footer and by examining the source code available on GitHub. This information disclosure vulnerability has been patched in PILOS in v4.8.0.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00261 · 16.9th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-497 · Exposure of Sensitive System Information to an Unauthorized Control Sphere
Published
2025-10-28T01:15Z
Affected products (1)
ProductVersionsFixed in
thm/pilos< 4.8.04.8.0
References (2)
https://github.com/THM-Health/PILOS/commit/14655bc4f8128ffd2b3c25004b01d9a802808da8 · [email protected]https://github.com/THM-Health/PILOS/security/advisories/GHSA-q93h-5j6h-j22x · [email protected]
EPSS history
Timeline
  • 27 OCT 20:18Z
    PILOS Exposes PHP version
    cvelistv5