CVE-2025-62524

MEDIUM

PILOS < 4.8.0 - PHP Version Exposure via X-Powered-By Header

Title source: llm
STIX 2.1

Description

PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. PILOS before 4.8.0 exposes the PHP version via the X-Powered-By header, enabling attackers to fingerprint the server and assess potential exploits. This information disclosure vulnerability originates from PHP’s base image. Additionally, the PHP version can also be inferred through the PILOS version displayed in the footer and by examining the source code available on GitHub. This information disclosure vulnerability has been patched in PILOS in v4.8.0.

References (2)

Core 2

Scores

CVSS v3 5.3
EPSS 0.0022
EPSS Percentile 12.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-200 CWE-497
Status published
Products (1)
thm/pilos < 4.8.0
Published Oct 27, 2025
Tracked Since Feb 18, 2026