CVE-2025-61959
Vertikal Systems Hospital Manager Backend Services Generation of Error Message Containing Sensitive Information
- State
- Published
- Severity
- 6.9 Medium
- Published
- Oct 29, 2025
- Updated
- Oct 30, 2025
- Reserved
- Oct 8, 2025
Description
Prior to September 19, 2025, the Hospital Manager Backend Services returned verbose ASP.NET error pages for invalid WebResource.axd requests, disclosing framework and ASP.NET version information, stack traces, internal paths, and the insecure configuration 'customErrors mode="Off"', which could have facilitated reconnaissance by unauthenticated attackers.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | icscert |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | icscert |
Weaknesses
- CWE-209 Generation of Error Message Containing Sensitive Information
Affected Products
| Product | Versions |
|---|---|
Hospital Manager Backend ServicesVertikal Systems |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.