CVE-2022-25507

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

FreeTAKServer-UI v1.9.8 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Callsign parameter.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Mar 11, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-255087.5An access control issue in the component /ManageRoute/postRoute of FreeTAKServer v1.9.8 allows unauthenticated attackers to cause a Denial oCVE-2022-25517.5The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpCVE-2022-255108.8FreeTAKServer 1.9.8 contains a hardcoded Flask secret key which allows attackers to create crafted cookies to bypass authentication or escalCVE-2022-255116.5An issue in the ?filename= argument of the route /DataPackageTable in FreeTAKServer-UI v1.9.8 allows attackers to place arbitrary files anywCVE-2022-255127.5FreeTAKServer-UI v1.9.8 was discovered to leak sensitive API and Websocket keys.CVE-2022-255147.5stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function ttUSHORT() at stb_truetype.h. NOTE: Third party has dCVE-2022-255156.5stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function ttULONG() at stb_truetype.h. NOTE: Third party has diCVE-2022-255166.5stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function stbtt__find_table at stb_truetype.h. NOTE: Third partCVE-2022-255179.8MyBatis plus v3.4.3 was discovered to contain a SQL injection vulnerability via the Column parameter in /core/conditions/AbstractWrapper.javCVE-2022-255186.5In CMDBuild from version 3.0 to 3.3.2 payload requests are saved in a temporary log table, which allows attackers with database access to reCVE-2022-25525.3The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information about the system suchCVE-2022-255219.8NUUO v03.11.00 was discovered to contain access control issue.
CVE-2022-25507: Medium severity, CVSS 5.4 | Vulnix