What is the CVSS score of CVE-2025-52025?

CVE-2025-52025 has a CVSS 3.1 base score of 9.4 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Gemscms Backend are affected by CVE-2025-52025?

A critical SQL injection vulnerability in the Aptsys gemscms POS Platform backend could allow attackers to gain unauthorized access to restaurant data, manipulate transactions, and compromise payment…

How to fix or mitigate CVE-2025-52025?

Within 24 hours: Isolate affected POS systems from internet-facing networks and disable the GetServiceByRestaurantID endpoint if operationally feasible; document all current users and access logs. Within 7 days: Implement Web Application Firewall (WAF) rules to block SQL injection patterns targeting this endpoint; conduct forensic review of access logs for signs of exploitation. Within 30 days: Contact Aptsys for patch availability and timeline; evaluate alternative POS providers if patch is unavailable; execute full security assessment of the platform.

Gemscms Backend CVE-2025-52025

CRITICAL

SQL Injection (CWE-89)

2026-01-23 cve@mitre.org

SQLi Gemscms Backend

9.4

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.4 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 23, 2026 - 21:15 nvd

CRITICAL 9.4

DescriptionCVE.org

An SQL Injection vulnerability exists in the GetServiceByRestaurantID endpoint of the Aptsys gemscms POS Platform backend thru 2025-05-28. The vulnerability arises because user input is directly inserted into a dynamic SQL query syntax without proper sanitization or parameterization. This allows an attacker to inject and execute arbitrary SQL code by submitting crafted input in the id parameter, leading to unauthorized data access or modification.

AnalysisAI

Aptsys gemscms POS Platform has a SQL injection in the GetServiceByRestaurantID endpoint allowing extraction of restaurant and payment data.

Technical ContextAI

The GetServiceByRestaurantID endpoint in Aptsys gemscms has a CWE-89 SQL injection that allows unauthenticated attackers to inject arbitrary SQL commands through the restaurant ID parameter.