CVE-2025-9313 — Unauthorized database access in Asseco mMedica
An unauthenticated user can connect to a publicly accessible database using arbitrary credentials. The system grants full access to the database by leveraging a previously authe…
Published: 2025-10-28 · CVSS: 9.3 · CVSS 4.0
An unauthenticated user can connect to a publicly accessible database using arbitrary credentials. The system grants full access to the database by leveraging a previously authenticated connection through a "mmBackup" application. This flaw allows attackers to bypass authentication mechanisms and gain unauthorized access to database with sensitive data. This issue affects Asseco mMedica in versions before 11.9.5.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7