CVE-2025-66501
5.4
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Exploitability: 2.3 / Impact: 2.7
Source: NVD
Description
A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Predefined Text feature of the Foxit eSign section. A crafted payload can be stored via the Identity “First Name” field, which is later rendered into the DOM without proper sanitization. As a result, the injected script may execute when predefined text is used or when viewing document properties.
Affected (1)
Products: Foxit: Pdf Editor Cloud
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Before 2025-12-01 |
References (1)
Source: 14984358-7092-470d-8f34-ade47a7658a2
Vendor Advisory
Timeline
No history available yet.