PT-2026-7988 · Universal Software · Flexcity/Kiosk

İbrahim Yi̇ği̇tsoy · Published 2026-02-13 · Updated 2026-03-02 · CVE-2025-14349

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Universal Software Inc. FlexCity/Kiosk versions prior to 1.0.36

Description A flaw exists in Universal Software Inc. FlexCity/Kiosk that allows accessing functionality not properly constrained by Access Control Lists (ACLs), potentially leading to privilege escalation. The issue stems from privileges defined with unsafe actions and missing authentication for a critical function.

Recommendations Update FlexCity/Kiosk to version 1.0.36 or later.

Fix

LPE

Missing Authentication

Weakness Enumeration

CWE-267

CWE-306

Related Identifiers

CVE-2025-14349

Affected Products

Flexcity/Kiosk

References · 6

• https://osv.dev/vulnerability/CVE-2025-14349 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14349 · Security Note
• https://twitter.com/cracbot/status/2024076472013726007 · Twitter Post
• https://t.me/CVEtracker/44615 · Telegram Post
• https://usom.gov.tr/bildirim/tr-26-0065 · Note
• https://t.me/cveNotify/153719 · Telegram Post