CVE-2025-9313
An unauthenticated user can connect to a publicly accessible database using arbitrary credentials. The system grants full access to the database by leveraging a previously authenticated connection through a "mmBackup" application. This flaw allows attackers to bypass authentication mechanisms and gain unauthorized access to database with sensitive data. This issue affects Asseco mMedica in versions before 11.9.5.
- Score
- CVSS 4.0 9.3 Critical
- Status
- Deferred - cvd@cert.pl
- Published
- 2025-10-28
- Last modified
- 2026-10-08
- Weaknesses
- CWE-288
Affected products
References
- https://cert.pl/en/posts/2025/10/CVE-2025-9313/
- https://mmedica.asseco.pl/
