What is the CVSS score of CVE-2025-52024?

CVE-2025-52024 has a CVSS 3.1 base score of 9.4 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Gemscms Backend are affected by CVE-2025-52024?

A critical vulnerability in Aptsys POS Platform Web Services allows unauthenticated attackers to access internal API testing tools, potentially enabling unauthorized data theft, system manipulation,…

How to fix or mitigate CVE-2025-52024?

Within 24 hours: Identify all Aptsys POS systems in your environment and isolate affected instances from production networks if possible; enable enhanced logging on these systems. Within 7 days: Deploy compensating controls (WAF rules, network segmentation, IP whitelisting) to restrict access to the Web Services module; conduct vulnerability scanning for evidence of exploitation. Within 30 days: Engage with Aptsys for patch timeline; evaluate alternative POS platforms if patch availability remains uncertain; complete forensic analysis for any unauthorized access.

Gemscms Backend CVE-2025-52024

CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-01-23 cve@mitre.org

Authentication Bypass Gemscms Backend

9.4

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.4 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 23, 2026 - 21:15 nvd

CRITICAL 9.4

DescriptionCVE.org

A vulnerability exists in the Aptsys POS Platform Web Services module thru 2025-05-28, which exposes internal API testing tools to unauthenticated users. By accessing specific URLs, an attacker is presented with a directory-style index listing all available backend services and POS web services, each with an HTML form for submitting test input. These panels are intended for developer use, but are accessible in production environments with no authentication or session validation. This grants any external actor the ability to discover, test, and execute API endpoints that perform critical functions including but not limited to user transaction retrieval, credit adjustments, POS actions, and internal data queries.

AnalysisAI

Aptsys POS Platform Web Services module exposes internal API testing endpoints to the public, allowing unauthenticated access to point-of-sale backend systems.

Technical ContextAI

The Aptsys POS Platform has internal API testing endpoints exposed without authentication (CWE-306), providing direct access to POS backend functionality including payment processing and order management.