CVE-2025-14349

HIGH 8.8CVE-2025-14349 · Published 13/02/2026 · updated 17/06/2026

In short

CVE-2025-14349 is a HIGH (CVSS 8.8) vulnerability affecting flexcity (uni-yaz).
Chance of exploitation in the next 30 days (EPSS): 0.41%, higher than 35.1% of all vulnerabilities.
Fix: update to 1.0.36 or later.

Package	Affected versions	Patched versions
flexcity uni-yaz	`≥ 1.0, < 1.0.36`	`1.0.36`

Description

Privilege Defined With Unsafe Actions, Missing Authentication for Critical Function vulnerability in Universal Software Inc. FlexCity/Kiosk allows Accessing Functionality Not Properly Constrained by ACLs, Privilege Escalation. This issue affects FlexCity/Kiosk: from 1.0 before 1.0.36.

References

siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0065
usom.gov.tr/bildirim/tr-26-0065 · Third Party Advisory

More vulnerabilities in flexcity

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free