What is the CVSS score of CVE-2025-52026?

CVE-2025-52026 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Gemscms Backend are affected by CVE-2025-52026?

An unauthenticated attacker can access sensitive cashier account credentials through a publicly exposed API endpoint in Aptsys gemscms, potentially enabling unauthorized access to financial systems…

How to fix or mitigate CVE-2025-52026?

Within 24 hours: Immediately disable or restrict network access to the /srvs/membersrv/getCashiers endpoint; inventory all systems running gemscms versions through 2025-05-28 and assess exposure. Within 7 days: Reset all cashier account passwords; conduct forensic audit of access logs to detect unauthorized API queries; validate no credentials were compromised in external breach databases. Within 30 days: Upgrade to patched gemscms version when available; implement API authentication controls; deploy Web Application Firewall rules to block unauthenticated endpoint access; establish continuous monitoring for suspicious API activity.

Gemscms Backend CVE-2025-52026

HIGH

Information Exposure (CWE-200)

2026-01-23 cve@mitre.org

Information Disclosure Gemscms Backend

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 23, 2026 - 21:15 nvd

HIGH 7.5

DescriptionCVE.org

An information disclosure vulnerability exists in the /srvs/membersrv/getCashiers endpoint of the Aptsys gemscms backend platform thru 2025-05-28. This unauthenticated endpoint returns a list of cashier accounts, including names, email addresses, usernames, and passwords hashed using MD5. As MD5 is a broken cryptographic function, the hashes can be easily reversed using public tools, exposing user credentials in plaintext. This allows remote attackers to perform unauthorized logins and potentially gain access to sensitive POS operations or backend functions.

AnalysisAI

Technical ContextAI

Classified as CWE-200 (Information Exposure). Affects Gemscms Backend. An information disclosure vulnerability exists in the /srvs/membersrv/getCashiers endpoint of the Aptsys gemscms backend platform thru 2025-05-28. This unauthenticated endpoint returns a list of cashier accounts, including names, email addresses, usernames, and passwords hashed using MD5. As MD5 is a broken cryptographic function, the hashes can be easily reversed using public tools, exposing user credentials in plaintext. This allows remote attackers to perform unauthorized logins and potential