PT-2026-4529 · Aptsys · Aptsys Pos Platform Web Services

Published 2026-01-23 · Updated 2026-02-11 · CVE-2025-52024

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Aptsys POS Platform Web Services versions prior to 2025-05-29

Description The Aptsys POS Platform Web Services module contains a flaw that allows unauthenticated users to access internal API testing tools. Accessing specific URLs reveals a directory listing of backend services and POS web services, complete with HTML forms for submitting test input. These tools, intended for developers, are accessible in production without authentication or session validation. This allows external actors to discover, test, and execute API endpoints that perform critical functions, including user transaction retrieval, credit adjustments, POS actions, and internal data queries. The affected API endpoints include those for user transaction retrieval, credit adjustments, POS actions, and internal data queries.

Recommendations Versions prior to 2025-05-29 should be updated.

Fix

Missing Authentication

Missing Authorization

Weakness Enumeration

CWE-306

CWE-862

CWE-425

Related Identifiers

CVE-2025-52024

Affected Products

Aptsys Pos Platform Web Services

References · 9

• https://osv.dev/vulnerability/CVE-2025-52024 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-52024 · Security Note
• https://gist.github.com/ReverseThatApp/4a6be2b9b2ba39d38c35c8753e0afd39 · Note
• https://twitter.com/CVEnew/status/2015362488762765678 · Twitter Post
• https://t.me/cveNotify/151747 · Telegram Post
• https://twitter.com/TheHackerWire/status/2015851077615362099 · Twitter Post
• http://aptsys.com · Note
• https://twitter.com/VulmonFeeds/status/2014837502247325984 · Twitter Post
• https://t.me/CVEtracker/42883 · Telegram Post