CVE-2025-62524 - CVE House
Back to Database
Status published Medium CVE-2025-62524

PILOS Exposes PHP version

Vulnerability Description

PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. PILOS before 4.8.0 exposes the PHP version via the X-Powered-By header, enabling attackers to fingerprint the server and assess potential exploits. This information disclosure vulnerability originates from PHP’s base image. Additionally, the PHP version can also be inferred through the PILOS version displayed in the footer and by examining the source code available on GitHub. This information disclosure vulnerability has been patched in PILOS in v4.8.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-62524

Credits & Attribution

No credits recorded in the NVD database.

References

More from THM-Health

View All →
CVE-2025-62781
PILOS is missing session regeneration after password change
Medium 5
CVE-2025-62523
PILOS Misconfigured the Access-Control-Allow-Origin Header
Medium 6.3
CVE-2023-47107
PILOS account takeover through password reset poisoning
High 8.8

Affected Vendor

Affected Software

PILOS
Vulnerable Versions:
< 4.8.0

Timeline

Official Publish: October 27th, 2025
Last Modified: October 27th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-200 CWE-497

MITRE ATT&CK TTPs

T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1041 Exfiltration Over C2 Channel
Exfiltration
T1592 Gather Victim Host Information
Reconnaissance
T1082 System Information Discovery
Discovery