Stored Cross-Site Scripting Vulnerability in Foxit's PDF Online Tool
CVE-2025-66502

6.3MEDIUM

Key Information:

Vendor

Foxit Inc.

Status
PDFonline.foxit.com
Vendor
CVE Published:
19 December 2025

What is CVE-2025-66502?

A stored cross-site scripting vulnerability exists in Foxit's PDF Online service within the Page Templates functionality. An attacker can craft a malicious payload that, when saved as a template name, is executed when the corresponding PDF is subsequently loaded. This occurs due to inadequate sanitization of the rendered output, enabling the injected script to execute within the user's browser environment, which could lead to unauthorized access or data manipulation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

pdfonline.foxit.com before 2025‑12‑01

References

https://www.foxit.com/support/security-bulletins.html

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

thisis0xczar from Novee.io
JSON
.