CVE-2025-61959

MediumCVSS 5.3

Published: 29/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

18th percentile - higher than 18% of all known CVEs

Summary

Prior to September 19, 2025, the Hospital Manager Backend Services returned verbose ASP.NET error pages for invalid WebResource.axd requests, disclosing framework and ASP.NET version information, stack traces, internal paths, and the insecure configuration 'customErrors mode="Off"', which could have facilitated reconnaissance by unauthenticated attackers.

Risk Assessment

The risk is the disclosure of sensitive technical information that could help attackers in planning further attacks. This could lead to increased effectiveness of attacks on the system.

Recommendation

Configure error pages to not disclose technical details, and enable customErrors mode="On" or "RemoteOnly". Also consider updating the system to a version that includes a fix.

Other vulnerabilities in Hospital Manager Backend Services

CVE-2025-54459High
Prior to September 19, 2025, the Hospital Manager Backend Services exposed the ASP.NET tracing endpoint /trace.axd without authentication, allowing a remote attacker to obtain live request traces and sensitive information such as request metadata, session identifiers, authorization headers, server variables, and internal file paths.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS