CVE-2025-66502
Foxit pdfonline.foxit.com Stored Cross-Site Scripting in Page Templates Feature
Vexday Risk Score
13Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 6.3EPSS 0.1%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
19 dic 2025Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Page Templates feature. A crafted payload can be stored as the template name, which is later rendered into the DOM without proper sanitization. As a result, the injected script executes each time the affected PDF is loaded.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
Productos afectados
Foxit Software Inc. · pdfonline.foxit.com¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →