Vulnerability · Published Oct 29, 2025 · Assigned by icscert
CVE-2025-54459Vertikal Systems Hospital Manager Backend Services Exposure of Sensitive System Information to an Unauthorized Control Sphere
High 7.5
In plain English
A high-severity security flaw in Hospital Manager Backend Services from Vertikal Systems. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 63.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Prior to September 19, 2025, the Hospital Manager Backend Services exposed the ASP.NET tracing endpoint /trace.axd without authentication, allowing a remote attacker to obtain live request traces and sensitive information such as request metadata, session identifiers, authorization headers, server variables, and internal file paths.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Vertikal Systems | Hospital Manager Backend Services | 0 – through September 19, 2025 |
Weakness: CWE-497 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N