This vulnerability involves the PHP backend of gemscms.aptsys.com.sg allowing unauthenticated remote attackers to cause the system to generate detailed error messages. These messages reveal sensitive internal information such as file paths, code snippets, and stack traces when crafted HTTP requests are sent to public API endpoints. The issue is categorized as CWE-209: Information Exposure Through an Error Message. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality impact.

The vulnerability exposes internal server information including file paths, code snippets, and stack traces to unauthenticated remote attackers. This information disclosure could aid attackers in crafting further targeted attacks or exploitation attempts. There is no direct impact on integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided. Until a patch is available, consider restricting access to the affected API endpoints or implementing error handling that does not disclose sensitive internal information.