Universal Software Inc
Monthly
Missing authorization in Universal Software Inc. FlexCity (versions 5.536.0 through 11052026) exposes sensitive data to low-privileged authenticated users who can bypass access control security levels. The vulnerability (CWE-862) allows network-accessible exploitation with low attack complexity, resulting in high confidentiality impact with no integrity or availability loss. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low-privilege network vector makes this a realistic internal threat in any environment running affected versions.
FlexCity by Universal Software Inc. exposes an authentication rate-limiting failure (CWE-307) across versions 5.536.0 through 11052026, allowing low-privileged network attackers to submit unbounded authentication requests and cause excessive server-side resource allocation that degrades availability. The CVSS vector (AV:N/AC:L/PR:L/A:L) indicates a moderate, network-reachable flaw requiring existing credentials, though the vendor-applied 'Information Disclosure' tag conflicts with the C:N CVSS metric and raises the possibility of concurrent username enumeration not captured in the base score. Reported by TR-CERT; no public exploit code and no CISA KEV listing exist at time of analysis.
Open redirect in Universal Software Inc. FlexCity (versions 5.536.0 through 11052026) enables remote unauthenticated attackers to craft trusted-domain URLs that silently redirect victims to arbitrary external sites, facilitating phishing and credential harvesting. The CVSS 6.1 (Medium) vector carries S:C (Changed scope), confirming the impact escapes the application boundary to affect users on third-party systems. No public exploit code and no CISA KEV listing have been identified at time of analysis, reported by TR-CERT.
Missing authorization in Universal Software Inc. FlexCity (versions 5.536.0 through 11052026) exposes sensitive data to low-privileged authenticated users who can bypass access control security levels. The vulnerability (CWE-862) allows network-accessible exploitation with low attack complexity, resulting in high confidentiality impact with no integrity or availability loss. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low-privilege network vector makes this a realistic internal threat in any environment running affected versions.
FlexCity by Universal Software Inc. exposes an authentication rate-limiting failure (CWE-307) across versions 5.536.0 through 11052026, allowing low-privileged network attackers to submit unbounded authentication requests and cause excessive server-side resource allocation that degrades availability. The CVSS vector (AV:N/AC:L/PR:L/A:L) indicates a moderate, network-reachable flaw requiring existing credentials, though the vendor-applied 'Information Disclosure' tag conflicts with the C:N CVSS metric and raises the possibility of concurrent username enumeration not captured in the base score. Reported by TR-CERT; no public exploit code and no CISA KEV listing exist at time of analysis.
Open redirect in Universal Software Inc. FlexCity (versions 5.536.0 through 11052026) enables remote unauthenticated attackers to craft trusted-domain URLs that silently redirect victims to arbitrary external sites, facilitating phishing and credential harvesting. The CVSS 6.1 (Medium) vector carries S:C (Changed scope), confirming the impact escapes the application boundary to affect users on third-party systems. No public exploit code and no CISA KEV listing have been identified at time of analysis, reported by TR-CERT.