CVE-2025-52022

The PHP backend of the Aptsys Gemscms POS Platform (specifically gemsloyalty.aptsys.com.sg) is vulnerable to information exposure through error messages (CWE-209 ). Unauthenticated remote attackers can send specially crafted HTTP GET/POST requests to public API endpoints to trigger detailed error...

CVE-2025-52024

The Aptsys POS Platform Web Services module (versions prior to 2025-05-29 ) contains a vulnerability where internal API testing tools are exposed to unauthenticated users in production environments. By accessing specific URLs, an attacker can view a directory-style index of backend services and u...

CVE-2025-52023

A vulnerability in the PHP backend of the Aptsys Gemscms POS Platform (versions prior to 2025-05-28 ) allows unauthenticated remote attackers to trigger detailed error messages. By sending specially crafted HTTP GET/POST requests to public API endpoints, attackers can cause the system to disclose...

CVE-2025-52026

An information disclosure vulnerability exists in the Aptsys gemscms backend platform (versions prior to 2025-05-29 ) within the /srvs/membersrv/getCashiers endpoint. This unauthenticated API endpoint returns a list of cashier accounts, including names, email addresses, usernames, and passwords h...

CVE-2025-52025

The Aptsys gemscms POS Platform (versions prior to 2025-05-29 ) contains an SQL Injection vulnerability in the GetServiceByRestaurantID endpoint. The root cause is the direct insertion of user-supplied input into a dynamic SQL query without sufficient sanitization or parameterization. An attacker...