TI-2025-13110 Aliases CVE-2025-14349 GHSA-q3vc-646j-prpq

Business Logic Error in Universal Software's FlexCity/Kiosk

MEDIUM 40CWE-267Published 2026-02-13 · Updated 2026-06-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

Privilege Defined With Unsafe Actions, Missing Authentication for Critical Function vulnerability in Universal Software Inc. FlexCity/Kiosk allows Accessing Functionality Not Properly Constrained by ACLs, Privilege Escalation. This issue affects FlexCity/Kiosk: from 1.0 before 1.0.36.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00407 35th percentileScored 2026-11-07

Fix Fixed FlexCity/Kiosk (Universal Software Inc.): 1.0.36

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Universal Software Inc.	FlexCity/Kiosk	1.0 to before 1.0.36	1.0.36	Patch available	CNA

FlexCity/Kiosk VendorUniversal Software Inc. Affected 1.0 to before 1.0.36 Fixed in 1.0.36 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:uni-yaz:flexcity::::::::	1.0 to before 1.0.36	Vulnerable	Universal Software Inc.

cpe:2.3:a:uni-yaz:flexcity:*:*:*:*:*:*:*:* Versions 1.0 to before 1.0.36 Vulnerable ·Universal Software Inc.

Remediation

Fix · CNA FlexCity/Kiosk (Universal Software Inc.) Fixed in 1.0.36

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-02-13
Universal Software FlexCity/Kiosk 1.0.36
3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-01304 Admin Account Takeover in Universal Sotware's FlexCity/KioskPriority MEDIUM 40
- TI-2026-01305 IDOR in Universal Sotware's FlexCity/KioskPriority LOW 38
Show all 3 records →

Timeline

2026-10-02 Threatist record created from CVE-2025-14349
2026-10-03 Alias added: GHSA-q3vc-646j-prpq

References

Advisory 1

https://www.usom.gov.tr/bildirim/tr-26-0065

Other 1

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0065

TI-2026-01304 Admin Account Takeover in Universal Sotware's FlexCity/Kiosk CVSS 3.1HIGH 8.8
TI-2026-01305 IDOR in Universal Sotware's FlexCity/Kiosk CVSS 3.1HIGH 8.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences