Vulnerability · Published Oct 27, 2025 · Assigned by GitHub_M

CVE-2025-62524PILOS Exposes PHP version

Medium 5.3

In plain English

A medium-severity information exposure in PILOS from THM-Health. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 82.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. PILOS before 4.8.0 exposes the PHP version via the X-Powered-By header, enabling attackers to fingerprint the server and assess potential exploits. This information disclosure vulnerability originates from PHP’s base image. Additionally, the PHP version can also be inferred through the PILOS version displayed in the footer and by examining the source code available on GitHub. This information disclosure vulnerability has been patched in PILOS in v4.8.0.

Affected products (as reported)

Vendor	Product	Versions
THM-Health	PILOS	< 4.8.0

Weakness: CWE-200, CWE-497 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/THM-Health/PILOS/security/advisories/GHSA-q93h-5j6h-j22x x_refsource_CONFIRM
https://github.com/THM-Health/PILOS/commit/14655bc4f8128ffd2b3c25004b01d9a802808da8 x_refsource_MISC