What is the CVSS score of CVE-2026-8284?

CVE-2026-8284 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

FlexCity CVE-2026-8284

EUVD-2026-46186 MEDIUM

URL Redirection to Untrusted Site (Open Redirect) (CWE-601)

2026-07-21 TR-CERT

GHSA-54rq-gf2j-3p48

Open Redirect Flexcity

6.1

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Network-reachable redirect requiring no privileges; UI:R because victim must click crafted link; S:C because redirect escapes application boundary; no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (TR-CERT).

CVSS VectorVendor: TR-CERT

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 13:16 vuln.today

DescriptionCVE.org

URL redirection to untrusted site ('open redirect') vulnerability in Universal Software Inc. FlexCity allows Input Data Manipulation.

This issue affects FlexCity: from 5.536.0 through 11052026.

AnalysisAI

Open redirect in Universal Software Inc. FlexCity (versions 5.536.0 through 11052026) enables remote unauthenticated attackers to craft trusted-domain URLs that silently redirect victims to arbitrary external sites, facilitating phishing and credential harvesting. The CVSS 6.1 (Medium) vector carries S:C (Changed scope), confirming the impact escapes the application boundary to affect users on third-party systems. No public exploit code and no CISA KEV listing have been identified at time of analysis, reported by TR-CERT.

Technical ContextAI

CWE-601 (URL Redirection to Untrusted Site) describes a class of flaws where user-supplied input determines a redirect destination without adequate whitelist or allowlist enforcement on the server side. FlexCity (CPE: cpe:2.3:a:universal_software_inc.:flexcity:*:*:*:*:*:*:*:*), a web application product by Universal Software Inc., fails to validate or restrict redirect target URLs, allowing external domains to be injected as redirect parameters. The CVSS metric S:C (Changed scope) is canonical for open redirect, reflecting that the trust boundary is crossed: the initial request hits FlexCity, but the security consequence (phishing landing page) is realized in a system outside the vulnerable component.

RemediationAI

Consult the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0593 and contact Universal Software Inc. directly for a patched release; no exact fixed version number was identified in available data, so 'Patch available per vendor advisory' is the most specific claim supportable. As a compensating control, implement server-side URL allowlisting on any redirect endpoint, rejecting destination parameters that do not match an approved list of internal domains - this directly neutralizes the CWE-601 root cause with no functional trade-off for legitimate use cases. Supplement with a redirect interstitial warning page that alerts users they are leaving the application, reducing the phishing effectiveness of any bypass. Web application firewall (WAF) rules blocking common open-redirect bypass patterns (protocol-relative URLs, CRLF injection, URL encoding tricks) can provide additional defense-in-depth but should not substitute for server-side fix.

More in Open Redirect

View all

CVE-2017-1000117 HIGH Act Now POC

8.8 Oct 05

A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca

CVE-2024-52875 HIGH Act Now POC

8.8 Jan 31

GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of

CVE-2016-5385 HIGH Act Now POC

8.1 Jul 19

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect

CVE-2013-2248 MEDIUM This Month POC

5.8 Jul 20

Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to

CVE-2012-6499 MEDIUM This Month POC

5.8 Jan 12

Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows

CVE-2015-2863 MEDIUM This Month POC

4.3 Jul 20

Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b

CVE-2017-3528 MEDIUM This Month POC

5.4 Apr 24

Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li

CVE-2012-0518 MEDIUM Act Now

4.7 Oct 16

Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3

CVE-2024-21641 MEDIUM This Month POC

6.5 Jan 05

Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp

CVE-2015-5354 MEDIUM This Month POC

5.8 Jul 01

Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites

CVE-2015-5461 MEDIUM This Month POC

6.4 Jul 08

Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for

CVE-2024-22891 CRITICAL Act Now POC

9.8 Mar 01

Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit

Same weakness CWE-601 – URL Redirection to Untrusted Site (Open Redirect)

View all

CVE-2017-1000117 HIGH POC

8.8

CVE-2016-5385 HIGH POC

8.1

CVE-2017-3528 MEDIUM POC

5.4

CVE-2012-0518 MEDIUM

4.7

CVE-2024-21641 MEDIUM POC

6.5

CVE-2015-5354 MEDIUM POC

5.8

CVE-2024-22891 CRITICAL POC

9.8

CVE-2022-40083 CRITICAL POC

9.6

CVE-2026-8284 vulnerability details – vuln.today

Back