Skip to content
CVE PROGRAM SOURCE RECORD6.3 Medium

CVE-2025-66522

Foxit pdfonline.foxit.com Stored Cross-Site Scripting in Digital IDs Common Name Field

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Foxit

Description

A stored cross-site scripting (XSS) vulnerability exists in the Digital IDs functionality of the Foxit PDF Editor Cloud (pdfonline.foxit.com). The application does not properly sanitize or encode the Common Name field of Digital IDs before inserting user-supplied content into the DOM. As a result, embedded HTML or JavaScript may execute whenever the Digital IDs dialog is accessed or when the affected PDF is loaded.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Foxit Software Inc. pdfonline.foxit.com

Default version status: unaffected

  • before 2025‑12‑01affected

References