PT-2026-4531 · Aptsys · Gemscms

Published 2026-01-23 · Updated 2026-02-12 · CVE-2025-52026

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Aptsys gemscms backend platform versions prior to 2025-05-29

Description An information disclosure issue exists in the /srvs/membersrv/getCashiers API endpoint of the Aptsys gemscms backend platform. This unauthenticated endpoint reveals a list of cashier accounts, including names, email addresses, usernames, and passwords hashed using MD5. Due to MD5 being a compromised cryptographic function, these hashes can be readily reversed using publicly available tools, exposing user credentials in plaintext. This allows remote attackers to perform unauthorized logins and potentially gain access to sensitive Point of Sale (POS) operations or backend functions.

Recommendations Versions prior to 2025-05-29 should be updated. As a temporary workaround, restrict access to the /srvs/membersrv/getCashiers endpoint.

Fix

Use of a Broken Cryptographic Algorithm

Information Disclosure

Weakness Enumeration

CWE-327

CWE-200

Related Identifiers

CVE-2025-52026

Affected Products

Gemscms

References · 8

• https://osv.dev/vulnerability/CVE-2025-52026 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-52026 · Security Note
• https://twitter.com/VulmonFeeds/status/2014829822829007048 · Twitter Post
• https://gist.github.com/ReverseThatApp/4a6be2b9b2ba39d38c35c8753e0afd39 · Note
• https://twitter.com/CVEnew/status/2015362490549563551 · Twitter Post
• http://aptsys.com · Note
• https://t.me/CVEtracker/42885 · Telegram Post
• https://t.me/cveNotify/151843 · Telegram Post