Disclosure summary
PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. PILOS before 4.8.0 exposes the PHP version via the X-Powered-By header, enabling attackers to fingerprint the server and assess potential exploits. This information disclosure vulnerability originates from PHP’s base image. Additionally, the PHP version can also be inferred through the PILOS version displayed in the footer and by examining the source code available on GitHub. This information disclosure vulnerability has been patched in PILOS in v4.8.0.
Source-reported weakness categories
CWE-200, CWE-497
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2025-62524
Open original source · Updated Oct 08, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
| Vendor | Product / association | Version / bounds |
|---|---|---|
| thm | pilos | * {"versionEndExcluding":"4.8.0"} |
Original records & references
- NIST NVD record
- CVE Program record
- github.com — Patch
- github.com — Mitigation, Vendor Advisory
PUBLISHED 2025-10-27T17:15:37-04:00
MODIFIED 2026-10-08T07:10:00-04:00
INGESTED 2026-10-08T12:35:13-04:00