Flexcity
Monthly
Flexcity versions up to 1.0.36. is affected by authorization bypass through user-controlled key (CVSS 8.3).
Flexcity versions before 1.0.36 contain an authentication bypass vulnerability that allows authenticated users to escalate their privileges through an alternate access path. An attacker with valid credentials can exploit this flaw to gain unauthorized elevated access to the system. No patch is currently available.
Missing authorization in Universal Software Inc. FlexCity (versions 5.536.0 through 11052026) exposes sensitive data to low-privileged authenticated users who can bypass access control security levels. The vulnerability (CWE-862) allows network-accessible exploitation with low attack complexity, resulting in high confidentiality impact with no integrity or availability loss. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low-privilege network vector makes this a realistic internal threat in any environment running affected versions.
FlexCity by Universal Software Inc. exposes an authentication rate-limiting failure (CWE-307) across versions 5.536.0 through 11052026, allowing low-privileged network attackers to submit unbounded authentication requests and cause excessive server-side resource allocation that degrades availability. The CVSS vector (AV:N/AC:L/PR:L/A:L) indicates a moderate, network-reachable flaw requiring existing credentials, though the vendor-applied 'Information Disclosure' tag conflicts with the C:N CVSS metric and raises the possibility of concurrent username enumeration not captured in the base score. Reported by TR-CERT; no public exploit code and no CISA KEV listing exist at time of analysis.
Open redirect in Universal Software Inc. FlexCity (versions 5.536.0 through 11052026) enables remote unauthenticated attackers to craft trusted-domain URLs that silently redirect victims to arbitrary external sites, facilitating phishing and credential harvesting. The CVSS 6.1 (Medium) vector carries S:C (Changed scope), confirming the impact escapes the application boundary to affect users on third-party systems. No public exploit code and no CISA KEV listing have been identified at time of analysis, reported by TR-CERT.
Privilege Defined With Unsafe Actions, Missing Authentication for Critical Function vulnerability in Universal Software Inc. FlexCity/Kiosk allows Accessing Functionality Not Properly Constrained by ACLs, Privilege Escalation.This issue affects FlexCity/Kiosk: from 1.0 before 1.0.36. [CVSS 8.8 HIGH]
Flexcity versions up to 1.0.36. is affected by authorization bypass through user-controlled key (CVSS 8.3).
Flexcity versions before 1.0.36 contain an authentication bypass vulnerability that allows authenticated users to escalate their privileges through an alternate access path. An attacker with valid credentials can exploit this flaw to gain unauthorized elevated access to the system. No patch is currently available.
Missing authorization in Universal Software Inc. FlexCity (versions 5.536.0 through 11052026) exposes sensitive data to low-privileged authenticated users who can bypass access control security levels. The vulnerability (CWE-862) allows network-accessible exploitation with low attack complexity, resulting in high confidentiality impact with no integrity or availability loss. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low-privilege network vector makes this a realistic internal threat in any environment running affected versions.
FlexCity by Universal Software Inc. exposes an authentication rate-limiting failure (CWE-307) across versions 5.536.0 through 11052026, allowing low-privileged network attackers to submit unbounded authentication requests and cause excessive server-side resource allocation that degrades availability. The CVSS vector (AV:N/AC:L/PR:L/A:L) indicates a moderate, network-reachable flaw requiring existing credentials, though the vendor-applied 'Information Disclosure' tag conflicts with the C:N CVSS metric and raises the possibility of concurrent username enumeration not captured in the base score. Reported by TR-CERT; no public exploit code and no CISA KEV listing exist at time of analysis.
Open redirect in Universal Software Inc. FlexCity (versions 5.536.0 through 11052026) enables remote unauthenticated attackers to craft trusted-domain URLs that silently redirect victims to arbitrary external sites, facilitating phishing and credential harvesting. The CVSS 6.1 (Medium) vector carries S:C (Changed scope), confirming the impact escapes the application boundary to affect users on third-party systems. No public exploit code and no CISA KEV listing have been identified at time of analysis, reported by TR-CERT.
Privilege Defined With Unsafe Actions, Missing Authentication for Critical Function vulnerability in Universal Software Inc. FlexCity/Kiosk allows Accessing Functionality Not Properly Constrained by ACLs, Privilege Escalation.This issue affects FlexCity/Kiosk: from 1.0 before 1.0.36. [CVSS 8.8 HIGH]