CVE-2025-61959

MEDIUM 5.3CVE-2025-61959 · Published 29/10/2025 · updated 08/10/2026

In short

CVE-2025-61959 is a MEDIUM (CVSS 5.3) vulnerability affecting hospital manager backend services (vertikalsystems).
Chance of exploitation in the next 30 days (EPSS): 0.27%, higher than 19.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
hospital manager backend services vertikalsystems	`≤ 2025-09-19`	No fix yet

Description

Prior to September 19, 2025, the Hospital Manager Backend Services returned verbose ASP.NET error pages for invalid WebResource.axd requests, disclosing framework and ASP.NET version information, stack traces, internal paths, and the insecure configuration 'customErrors mode="Off"', which could have facilitated reconnaissance by unauthenticated attackers.

References

cisa.gov/news-events/ics-medical-advisories/icsma-25-301-01 · Mitigation
vertikalsystems.com/en/products/pm/contact.php · Product

More vulnerabilities in hospital manager backend services

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free