CVE-2025-66522: falha de média gravidade em Foxit Software Inc. pdfonline.foxit.com
Foxit pdfonline.foxit.com Stored Cross-Site Scripting in Digital IDs Common Name Field
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.3epss 0.2%
A stored cross-site scripting (XSS) vulnerability exists in the Digital IDs functionality of the Foxit PDF Editor Cloud (pdfonline.foxit.com). The application does not properly sanitize or encode the Common Name field of Digital IDs before inserting user-supplied content into the DOM. As a result, embedded HTML or JavaScript may execute whenever the Digital IDs dialog is accessed or when the affected PDF is loaded.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
Produtos afetados
Foxit Software Inc. · pdfonline.foxit.comCVEs relacionadas — Foxit Software Inc. pdfonline.foxit.com
No mesmo produto, das mais perigosas para as menos.
CVE-2026-1592MEDIUMStored XSS via Create New Layer Field found in Foxit PDF Editor CloudEPSS 0.2%CVE-2026-1591MEDIUMStored XSS via Attachments Feature in https://pdfonline.foxit.com/EPSS 0.2%CVE-2025-66520MEDIUMFoxit pdfonline.foxit.com Stored Cross-Site Scripting in Portfolio SVG HandlingEPSS 0.2%CVE-2025-66519MEDIUMFoxit pdfonline.foxit.com Stored Cross-Site Scripting in Layer Import FunctionalityEPSS 0.2%CVE-2025-66502MEDIUMFoxit pdfonline.foxit.com Stored Cross-Site Scripting in Page Templates FeatureEPSS 0.2%CVE-2025-66501MEDIUMFoxit pdfonline.foxit.com Stored Cross-Site Scripting in eSign Predefined Text FeatureEPSS 0.2%