Stored Cross-Site Scripting Vulnerability in Foxit's PDF Online Tool

CVE-2025-66502

What is CVE-2025-66502?

A stored cross-site scripting vulnerability exists in Foxit's PDF Online service within the Page Templates functionality. An attacker can craft a malicious payload that, when saved as a template name, is executed when the corresponding PDF is subsequently loaded. This occurs due to inadequate sanitization of the rendered output, enabling the injected script to execute within the user's browser environment, which could lead to unauthorized access or data manipulation.

References