CVE-2025-54459

None

CVSS

—

EPSS

0.4%

Published

Oct 29, 2025

CISA due date

—

The record

Prior to September 19, 2025, the Hospital Manager Backend Services exposed the ASP.NET tracing endpoint /trace.axd without authentication, allowing a remote attacker to obtain live request traces and sensitive information such as request metadata, session identifiers, authorization headers, server variables, and internal file paths.

Affected packages

Ecosystem	Package	Introduced	Fixed