A vulnerability in the PHP backend of gemsloyalty.aptsys.com.sg thru 2025-05-28 allows unauthenticated remote attackers to trigger detailed error messages that disclose internal file paths, code snippets, and stack traces. This occurs when specially crafted HTTP GET/POST requests are sent to public API endpoints, exposing potentially sensitive information useful for further exploitation. This issue is classified under CWE-209: Information Exposure Through an Error Message.
References
| Link | Resource |
|---|---|
| http://aptsys.com | Product |
| https://gist.github.com/ReverseThatApp/4a6be2b9b2ba39d38c35c8753e0afd39 | Third Party Advisory |
Configurations
History
11 Feb 2026, 19:25
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://aptsys.com - Product | |
| References | () https://gist.github.com/ReverseThatApp/4a6be2b9b2ba39d38c35c8753e0afd39 - Third Party Advisory | |
| CPE | cpe:2.3:a:aptsys:gemscms_backend:*:*:*:*:*:*:*:* | |
| First Time |
Aptsys
Aptsys gemscms Backend |
26 Jan 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-209 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
23 Jan 2026, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-23 21:15
Updated : 2026-02-11 19:25
NVD link : CVE-2025-52022
Mitre link : CVE-2025-52022
CVE.ORG link : CVE-2025-52022
JSON object : View
Products Affected
aptsys
- gemscms_backend
CWE
CWE-209
Generation of Error Message Containing Sensitive Information