CVE-2022-25508

An access control issue in the component /ManageRoute/postRoute of FreeTAKServer v1.9.8 allows unauthenticated attackers to cause a Denial of Service (DoS) via an unusually large amount of created routes, or create unsafe or false routes for legitimate users.

• CWE-306

• https://github.com/FreeTAKTeam/FreeTakServer/issues/291Exploit, Issue Tracking, Third Party Advisory
• https://github.com/FreeTAKTeam/FreeTakServer/issues/291Exploit, Issue Tracking, Third Party Advisory

Published

Mar 11, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-25497CuppaCMS v1.0 was discovered to contain an arbitrary file re…5.3
• CVE-2022-25498CuppaCMS v1.0 was discovered to contain a remote code execut…9.8
• CVE-2022-2550OS Command Injection in GitHub repository hestiacp/hestiacp …8.8
• CVE-2022-25505Taocms v3.0.2 was discovered to contain a SQL injection vuln…9.8
• CVE-2022-25506FreeTAKServer-UI v1.9.8 was discovered to contain a SQL inje…6.5
• CVE-2022-25507FreeTAKServer-UI v1.9.8 was discovered to contain a stored c…5.4
• CVE-2022-2551The Duplicator WordPress plugin before 1.4.7 discloses the u…7.5
• CVE-2022-25510FreeTAKServer 1.9.8 contains a hardcoded Flask secret key wh…8.8
• CVE-2022-25511An issue in the ?filename= argument of the route /DataPackag…6.5
• CVE-2022-25512FreeTAKServer-UI v1.9.8 was discovered to leak sensitive API…7.5
• CVE-2022-25514stb_truetype.h v1.26 was discovered to contain a heap-buffer…7.5
• CVE-2022-25515stb_truetype.h v1.26 was discovered to contain a heap-buffer…6.5