CVE-2025-7381

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

ImpactThis is an information disclosure vulnerability originating from PHP's base image. This vulnerability exposes the PHP version through an X-Powered-By header, which attackers could exploit to fingerprint the server and identify potential weaknesses.

WorkaroundsThe mitigation requires changing the expose_php variable from "On" to "Off" in the file located at /usr/local/etc/php/php.ini.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-497

Affected software

Vendor	Product	Versions
mautic	Docker Mautic	<= 6.0.3-20250707-apache; <= 6.0.3-20250707-fpm; <= 5.2.7-20250707-apache; <= 5.2.7-20250707-fpm

References

https://github.com/mautic/docker-mautic/security/advisories/GHSA-89jm-p7jf-x8jx

Timeline

Published: Jul 9, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-73828.8A command injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to adjacent attackers achiev CVE-2025-73835.9Padding oracle attack vulnerability in Oberon microsystem AG’s Oberon PSA Crypto library in all versions since 1.0.0 and prior to 1.5.1 allo CVE-2025-73849.8The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, CVE-2025-73859.3Input from search query parameter in GOV CMS is not sanitized properly, leading to a Blind SQL injection vulnerability, which might be explo CVE-2025-73866.8Information exposure vulnerability in Hitachi Storage Navigator. This issue affects Hitachi Virtual Storage Platform 5100, 5200, 5500, 5600 CVE-2025-73875.5The Lana Downloads Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the endpoint parameters in versions up to, CVE-2025-73888.4It was possible to perform Remote Command Execution (RCE) via Java RMI interface in the OpenEdge AdminServer, allowing authenticated users t CVE-2025-73898.2A vulnerability in the AdminServer component of OpenEdge on all supported platforms grants its authenticated users OS-level access to the se CVE-2025-73909.1A malicious client can bypass the client certificate trust check of an opc.https server when the server endpoint is configured to allow only CVE-2025-73926.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Cookies Addons allows Cross-Sit CVE-2025-73939.8Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Mail Login allows Brute Force.This issue affects Mail Logi CVE-2025-73949.8In the OpenSSL compatibility layer implementation, the function RAND_poll() was not behaving as expected and leading to the potential for pr