CVE-2025-9313
Critical
Description
An unauthenticated user can connect to a publicly accessible database using arbitrary credentials. The system grants full access to the database by leveraging a previously authenticated connection through a "mmBackup" application. This flaw allows attackers to bypass authentication mechanisms and gain unauthorized access to database with sensitive data. This issue affects Asseco mMedica in versions before 11.9.5.
SeverityCritical
CVSS9.3
Exploit probability—
ProductmMedica
PublishedOct 28, 2025
First seenOct 28, 2025
Weakness typeCWE-288CWE-288
How to fix
Update
- Asseco Poland S.A. mMedica11.9.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Asseco Poland S.A. mMedica | v < 11.9.5 | 11.9.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.