CVE-2026-1592mediumCWE-79

CVE-2026-1592: falha de média gravidade em Foxit Software Inc. pdfonline.foxit.com

Stored XSS via Create New Layer Field found in Foxit PDF Editor Cloud

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar pdfonline.foxit.com

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.3epss 0.2%
Foxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the Create New Layer feature. Unsanitized user input is embedded into the HTML output, allowing arbitrary JavaScript execution when the layer is referenced. This issue affects pdfonline.foxit.com: before 2026‑02‑03.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
Produtos afetados
Foxit Software Inc. · pdfonline.foxit.com
CVEs relacionadas — Foxit Software Inc. pdfonline.foxit.com

No mesmo produto, das mais perigosas para as menos.

CVE-2026-1591MEDIUMStored XSS via Attachments Feature in https://pdfonline.foxit.com/EPSS 0.2%CVE-2025-66522MEDIUMFoxit pdfonline.foxit.com Stored Cross-Site Scripting in Digital IDs Common Name FieldEPSS 0.2%CVE-2025-66520MEDIUMFoxit pdfonline.foxit.com Stored Cross-Site Scripting in Portfolio SVG HandlingEPSS 0.2%CVE-2025-66519MEDIUMFoxit pdfonline.foxit.com Stored Cross-Site Scripting in Layer Import FunctionalityEPSS 0.2%CVE-2025-66502MEDIUMFoxit pdfonline.foxit.com Stored Cross-Site Scripting in Page Templates FeatureEPSS 0.2%CVE-2025-66501MEDIUMFoxit pdfonline.foxit.com Stored Cross-Site Scripting in eSign Predefined Text FeatureEPSS 0.2%