nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2025-14349 CVE-2025-14349
HIGH
Business Logic Error in Universal Software's FlexCity/Kiosk
Record summary
CVE-2025-14349 has a selected CVSS score of 8.8 (high).
Description
Privilege Defined With Unsafe Actions, Missing Authentication for Critical Function vulnerability in Universal Software Inc. FlexCity/Kiosk allows Accessing Functionality Not Properly Constrained by ACLs, Privilege Escalation. This issue affects FlexCity/Kiosk: from 1.0 before 1.0.36.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 13, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
FlexCity/KioskBrowse Universal Software Inc. / FlexCity/KioskDefault status: unaffected | CVE List | 1.0 to < 1.0.36 | affected |
References
3siberguvenlik.gov.trGovernment resource
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0065 usom.gov.trGovernment resourcebroken link
https://www.usom.gov.tr/bildirim/tr-26-0065