NVD disclosure day
CVE-2025-52025
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An SQL injection vulnerability in the Aptsys gemscms POS Platform backend's GetServiceByRestaurantID endpoint allows attackers to execute arbitrary SQL code by submitting crafted input. This could lead to unauthorized access or modification of data. Confirm if your systems use this platform and are exposed to this risk
CVE-2025-52024
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in the Aptsys POS Platform Web Services module allows unauthenticated users to access internal API testing tools, potentially enabling external actors to discover and execute critical functions such as transaction retrieval and credit adjustments. This lack of authentication and validation could lead to
CVE-2026-24423
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An unauthenticated remote code execution vulnerability exists in SmarterMail's ConnectToHub API. Attackers can direct the application to a malicious server, leading to the execution of operating system commands. This impacts organizations by potentially compromising systems and data.
CVE-2025-4320
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in Sufirmam software allows attackers to bypass authentication and recover user passwords through a weak recovery mechanism. This could lead to unauthorized account access and control if the software is reachable. The vendor has not responded to the disclosure of this critical issue.
CVE-2025-4319
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability in Sufirmam's authentication and password recovery mechanisms allows for brute-force attacks and password exploitation. This could lead to unauthorized access to user accounts and potentially sensitive information when the system is reachable over a network. The vendor has not responded to inqu