CVE-2025-52024

CVE-2025-52024 is a critical-severity vulnerability in Aptsys Gemscms Backend with a CVSS 3.x base score of 9.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-306.

Key facts

Description

A vulnerability exists in the Aptsys POS Platform Web Services module thru 2025-05-28, which exposes internal API testing tools to unauthenticated users. By accessing specific URLs, an attacker is presented with a directory-style index listing all available backend services and POS web services, each with an HTML form for submitting test input. These panels are intended for developer use, but are accessible in production environments with no authentication or session validation. This grants any external actor the ability to discover, test, and execute API endpoints that perform critical functions including but not limited to user transaction retrieval, credit adjustments, POS actions, and internal data queries.

Frequently asked questions

What is CVE-2025-52024?
A vulnerability exists in the Aptsys POS Platform Web Services module thru 2025-05-28, which exposes internal API testing tools to unauthenticated users. By accessing specific URLs, an attacker is presented with a directory-style index listing all available backend services and POS web services, each with an HTML form for submitting test input. These panels are intended for developer use, but are accessible in production environments with no authentication or session validation. This grants any external actor the ability to discover, test, and execute API endpoints that perform critical functions including but not limited to user transaction retrieval, credit adjustments, POS actions, and internal data queries.
How severe is CVE-2025-52024?
CVE-2025-52024 has a CVSS 3.x base score of 9.4, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability low.
Is CVE-2025-52024 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (33rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-52024?
CVE-2025-52024 affects Aptsys Gemscms Backend. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-52024?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2025-52024 have an EU (EUVD) identifier?
Yes. CVE-2025-52024 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-4235.
When was CVE-2025-52024 published?
CVE-2025-52024 was published on 2026-01-23 and last updated on 2026-07-05.

References

EU advisories (EUVD)

Affected products (1)

More vulnerabilities in Aptsys Gemscms Backend

All CVEs affecting Aptsys Gemscms Backend →

Other CWE-306 (Missing Authentication for Critical Function) vulnerabilities

Browse all CWE-306 (Missing Authentication for Critical Function) vulnerabilities →