CVE-2025-54459 Information disclosure in Hospital Manager Backend Services
Remote attackers can access unauthenticated ASP.NET tracing endpoints to steal sensitive system information, session IDs, and internal paths.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-54459?
CVE-2025-54459 is a high-severity vulnerability in Vertikal Systems Hospital Manager Backend Services, published on 29 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Prior to September 19, 2025, the Hospital Manager Backend Services exposed the ASP.NET tracing endpoint /trace.axd without authentication, allowing a remote attacker to obtain live request traces and sensitive information such as request metadata, session identifiers, authorization headers, server variables, and internal file paths.
Weakness: CWE-497
Which versions are affected by CVE-2025-54459?
It affects 1 product.
Products include Vertikalsystems Hospital Manager Backend Services.
How do I fix CVE-2025-54459?
No fix has been published for CVE-2025-54459 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-54459 being exploited?
There is no known exploitation of CVE-2025-54459 in the wild and no public exploit code.
Other vulnerabilities in Vertikal Systems Hospital Manager Backend Services
Sources
Also known as GHSA-xcg5-r6rf-c8w7.