CVE-2025-66501: falha de média gravidade em Foxit Software Inc. pdfonline.foxit.com
Foxit pdfonline.foxit.com Stored Cross-Site Scripting in eSign Predefined Text Feature
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.3epss 0.2%
A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Predefined Text feature of the Foxit eSign section. A crafted payload can be stored via the Identity “First Name” field, which is later rendered into the DOM without proper sanitization. As a result, the injected script may execute when predefined text is used or when viewing document properties.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
Produtos afetados
Foxit Software Inc. · pdfonline.foxit.comCVEs relacionadas — Foxit Software Inc. pdfonline.foxit.com
No mesmo produto, das mais perigosas para as menos.
CVE-2026-1592MEDIUMStored XSS via Create New Layer Field found in Foxit PDF Editor CloudEPSS 0.2%CVE-2026-1591MEDIUMStored XSS via Attachments Feature in https://pdfonline.foxit.com/EPSS 0.2%CVE-2025-66522MEDIUMFoxit pdfonline.foxit.com Stored Cross-Site Scripting in Digital IDs Common Name FieldEPSS 0.2%CVE-2025-66520MEDIUMFoxit pdfonline.foxit.com Stored Cross-Site Scripting in Portfolio SVG HandlingEPSS 0.2%CVE-2025-66519MEDIUMFoxit pdfonline.foxit.com Stored Cross-Site Scripting in Layer Import FunctionalityEPSS 0.2%CVE-2025-66502MEDIUMFoxit pdfonline.foxit.com Stored Cross-Site Scripting in Page Templates FeatureEPSS 0.2%