Is CVE-2025-52024 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-52024 being exploited in the wild.

How severe is CVE-2025-52024?

Critical severity, with a CVSS score of 9.4, published 23 January 2026.

Which products and versions are affected?

Aptsys gemscms POS Platform Web Services through 2025-05-28.

Is there a fix for CVE-2025-52024?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-52024 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2025-52024?

Check whether you run Aptsys gemscms POS Platform Web Services or Aptsys Gemscms Backend at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-52024: Aptsys gemscms POS Platform authentication bypass in Web Services module

CVE-2025-52024 · Severity: critical · CVSS 9.4 · Published 2026-01-23

Aptsys POS Platform, a system used for managing point-of-sale transactions and restaurant operations, contains a security flaw that exposes internal developer tools to the public internet. An unauthorized person can access these tools to view and execute sensitive commands, such as adjusting customer credits, retrieving transaction history, and performing internal data queries. This could lead to financial fraud, theft of customer data, and significant disruption to business operations.

Technologies: Aptsys Gemscms Backend. Vendors: Aptsys.

Quick answers

Is CVE-2025-52024 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-52024 being exploited in the wild.
How severe is CVE-2025-52024?: Critical severity, with a CVSS score of 9.4, published 23 January 2026.
Which products and versions are affected?: Aptsys gemscms POS Platform Web Services through 2025-05-28.
Is there a fix for CVE-2025-52024?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-52024 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2025-52024?: Check whether you run Aptsys gemscms POS Platform Web Services or Aptsys Gemscms Backend at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A security misconfiguration in the Aptsys gemscms POS Platform Web Services module allows unauthenticated access to internal developer testing panels. These panels, accessible via predictable URL paths in production environments, provide a directory-style index of backend services and HTML forms for submitting test input. A remote attacker can use these interfaces to discover and execute sensitive API endpoints without any session validation or authentication. Impacted functions include user transaction retrieval, credit adjustments, POS actions, and internal database queries. As of the advisory date, the vendor has not acknowledged the issue, and it remains unpatched.

Affected products

Aptsys gemscms POS Platform Web Services through 2025-05-28

Timeline

2025-04-01: other: Vulnerability discovered
2025-05-01: other: Vendor notified repeatedly through November 2025
2025-07-01: other: CVE reserved
2025-11-18: disclosed: Public disclosure via GitHub Gist
2026-01-23: advisory: NVD advisory published

References

https://gist.github.com/ReverseThatApp/4a6be2b9b2ba39d38c35c8753e0afd39

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.