Stored Cross-Site Scripting Vulnerability in Foxit PDF Online

CVE-2025-66519

What is CVE-2025-66519?

A stored cross-site scripting vulnerability exists in Foxit's PDF Online service, particularly in the Layer Import functionality. An attacker can exploit this vulnerability by injecting a carefully crafted payload into the 'Create new Layer' field. When this layer is accessed later, the malicious script executes within the browser's DOM, leading to potential data theft or session hijacking. Proper sanitization of user inputs is critical to mitigate this risk. For further information and best practices to secure your PDF documents, refer to the official security bulletins provided by Foxit.

References