https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-52026.htmlhttps://patchthecve.com/cve/CVE-2025-52026.htmlSun, 05 Jul 2026 02:16:54 +0000HIGH 7.5: An information disclosure vulnerability exists in the /srvs/membersrv/getCashiers endpoint of the Aptsys gemscms backend platform thru 2025-05-28. This unauthenticated endpoint returns a list of cashier accounts, including names, email addresses, usernames, and passwords hashed using MD5. As MD5 is https://patchthecve.com/cve/CVE-2025-52025.htmlhttps://patchthecve.com/cve/CVE-2025-52025.htmlSun, 05 Jul 2026 02:16:54 +0000CRITICAL 9.4: An SQL Injection vulnerability exists in the GetServiceByRestaurantID endpoint of the Aptsys gemscms POS Platform backend thru 2025-05-28. The vulnerability arises because user input is directly inserted into a dynamic SQL query syntax without proper sanitization or parameterization. This allows an https://patchthecve.com/cve/CVE-2025-52024.htmlhttps://patchthecve.com/cve/CVE-2025-52024.htmlSun, 05 Jul 2026 02:16:53 +0000CRITICAL 9.4: A vulnerability exists in the Aptsys POS Platform Web Services module thru 2025-05-28, which exposes internal API testing tools to unauthenticated users. By accessing specific URLs, an attacker is presented with a directory-style index listing all available backend services and POS web services, eachttps://patchthecve.com/cve/CVE-2025-52023.htmlhttps://patchthecve.com/cve/CVE-2025-52023.htmlSun, 05 Jul 2026 17:17:15 +0000MEDIUM 5.3: A vulnerability in the PHP backend of gemscms.aptsys.com.sg thru 2025-05-28 allows unauthenticated remote attackers to trigger detailed error messages that disclose internal file paths, code snippets, and stack traces. This occurs when specially crafted HTTP GET/POST requests are sent to public API https://patchthecve.com/cve/CVE-2025-52022.htmlhttps://patchthecve.com/cve/CVE-2025-52022.htmlSun, 05 Jul 2026 02:16:53 +0000MEDIUM 5.3: A vulnerability in the PHP backend of gemsloyalty.aptsys.com.sg thru 2025-05-28 allows unauthenticated remote attackers to trigger detailed error messages that disclose internal file paths, code snippets, and stack traces. This occurs when specially crafted HTTP GET/POST requests are sent to public