Vulnerability · Published Oct 28, 2025 · Assigned by CERT-PL

CVE-2025-9313Unauthorized database access in Asseco mMedica

Critical 9.3

In plain English

A critical-severity authentication bypass in mMedica from Asseco Poland S.A.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.4%top 62.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An unauthenticated user can connect to a publicly accessible database using arbitrary credentials. The system grants full access to the database by leveraging a previously authenticated connection through a "mmBackup" application. This flaw allows attackers to bypass authentication mechanisms and gain unauthorized access to database with sensitive data. This issue affects Asseco mMedica in versions before 11.9.5.

Affected products (as reported)

Vendor	Product	Versions
Asseco Poland S.A.	mMedica	0 – before 11.9.5

Weakness: CWE-288 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://cert.pl/en/posts/2025/10/CVE-2025-9313/ third-party-advisory
https://mmedica.asseco.pl/ product