Gemscms Backend vulnerabilities

3 known vulnerabilities in Gemscms Backend from Aptsys. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Gemscms Backend: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2025-52026Jan 23, 2026Aptsys

  An information disclosure vulnerability exists in the /srvs/membersrv/getCashiers endpoint of the Aptsys gemscms backend platform thru 2025-05-28. This unauthenticated endpoint returns a list of cashier accounts, including names, email addresses, usernames, an

• 9.4 Critical severity

  Gemscms Backend: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2025-52025Jan 23, 2026Aptsys

  An SQL Injection vulnerability exists in the GetServiceByRestaurantID endpoint of the Aptsys gemscms POS Platform backend thru 2025-05-28. The vulnerability arises because user input is directly inserted into a dynamic SQL query syntax without proper sanitizat

• 9.4 Critical severity

  Gemscms Backend: Missing Authentication for Critical Functionality

  CVE-2025-52024Jan 23, 2026Aptsys

  A vulnerability exists in the Aptsys POS Platform Web Services module thru 2025-05-28, which exposes internal API testing tools to unauthenticated users. By accessing specific URLs, an attacker is presented with a directory-style index listing all available ba