Universal Software Inc. vulnerabilities

Products

• FlexCity 3
• FlexCity/Kiosk 3
• E-Municipality 1
• FlexWater Corporate Water Management 1
• UKBS 1

Latest Universal Software Inc. CVEs

Newest publication first

1. CVE-2026-1621 Register Bypass in Universal Sotware's E-Municipality

   Published 2026-08-14

   Medium·CVSS 5.3

   Authentication bypass by primary weakness vulnerability in Universal Software Inc. E-Municipality allows Exploitation of Trusted Identifiers. This issue affects E-Municipality: from 20251127 before 20260204.

2. CVE-2026-7187 Improper Authentication in Universal Sotware's UKBS

   Published 2026-07-28

   High·CVSS 8.8

   Missing authentication for critical function vulnerability in Universal Software Inc. UKBS allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects UKBS: through 28072026. NOTE: The vendor was contacted and it was learned that the product is not support...

3. CVE-2026-6792 Improper Authorization in Universal Sotware's FlexCity

   Published 2026-07-21

   Medium·CVSS 6.5

   Missing Authorization vulnerability in Universal Software Inc. FlexCity allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects FlexCity: from 5.536.0 before 5.542.0.

4. CVE-2026-8285 OTP Bypass in Universal Sotware's FlexCity

   Published 2026-07-21

   Medium·CVSS 4.3

   Improper restriction of excessive authentication attempts vulnerability in Universal Software Inc. FlexCity allows Excessive Allocation. This issue affects FlexCity: from 5.536.0 before 5.542.0.

5. CVE-2026-8284 Open Redirect in Universal Sotware's FlexCity

   Published 2026-07-21

   Medium·CVSS 6.1

   URL redirection to untrusted site ('open redirect') vulnerability in Universal Software Inc. FlexCity allows Input Data Manipulation. This issue affects FlexCity: from 5.536.0 before 5.542.0.

6. CVE-2026-1619 IDOR in Universal Sotware's FlexCity/Kiosk

   Published 2026-02-13

   High·CVSS 8.3

   Authorization Bypass Through User-Controlled Key vulnerability in Universal Software Inc. FlexCity/Kiosk allows Exploitation of Trusted Identifiers. This issue affects FlexCity/Kiosk: from 1.0 before 1.0.36.

7. CVE-2026-1618 Admin Account Takeover in Universal Sotware's FlexCity/Kiosk

   Published 2026-02-13

   High·CVSS 8.8

   Authentication Bypass Using an Alternate Path or Channel vulnerability in Universal Software Inc. FlexCity/Kiosk allows Privilege Escalation. This issue affects FlexCity/Kiosk: from 1.0 before 1.0.36.

8. CVE-2025-14349 Business Logic Error in Universal Software's FlexCity/Kiosk

   Published 2026-02-13

   High·CVSS 8.8

   Privilege Defined With Unsafe Actions, Missing Authentication for Critical Function vulnerability in Universal Software Inc. FlexCity/Kiosk allows Accessing Functionality Not Properly Constrained by ACLs, Privilege Escalation. This issue affects FlexCity/Kiosk: from 1.0 before 1....

9. CVE-2024-0857 SQLi in Universal Software's FlexWater Corporate Water Management

   Published 2024-07-18

   Critical·CVSS 9.8

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Universal Software Inc. FlexWater Corporate Water Management allows SQL Injection. This issue affects FlexWater Corporate Water Management: before 5.452.0.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.