CVE-2025-62781

CVE-2025-62781 affects PILOS (Platform for Interactive Live-Online Seminars) versions prior to 4.8.0. This vulnerability allows an attacker who has previously compromised a user's session token to maintain access even after the legitimate user changes their password, as the active session token is not invalidated or refreshed. The vulnerability has a CVSS score of 5.0 (Medium) with an attack vector of Network and High attack complexity, indicating that some conditions must be met for successful exploitation. The potential impact involves low confidentiality, integrity, and availability, meaning an attacker could gain limited access to user data, modify minor information, or cause minor service disruption. Currently, there is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting it has not garnered significant attention.