CVE-2025-66523 - CVE House

Back to Database

Status published Medium CVE-2025-66523

Reflected Cross-Site Scripting (XSS) Vulnerability in na1.foxitesign.foxit.com via Unsanitized URL Parameters

6.1 CVSS

Vulnerability Description

URL parameters are directly embedded into JavaScript code or HTML attributes without proper encoding or sanitization. This allows attackers to inject arbitrary scripts when an authenticated user visits a crafted link. This issue affects na1.foxitesign.foxit.com: before 2026‑01‑16.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-66523

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Novee

References

https://www.foxit.com/support/security-bulletins.html

More from Foxit Software Inc.

View All →

Foxit pdfonline.foxit.com Stored Cross-Site Scripting in Digital IDs Common Name Field

Foxit pdfonline.foxit.com Stored Cross-Site Scripting in Trusted Certificates Feature

Foxit pdfonline.foxit.com Stored Cross-Site Scripting in Portfolio SVG Handling

Foxit pdfonline.foxit.com Stored Cross-Site Scripting in Layer Import Functionality

Foxit pdfonline.foxit.com Stored Cross-Site Scripting in Page Templates Feature

Affected Vendor

Foxit Software Inc.

View all reports →

Affected Software

na1.foxitesign.foxit.com

Vulnerable Versions:

before 2026‑01‑16

Timeline

Official Publish: January 20th, 2026

Last Modified: January 20th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1189 Drive-by Compromise

T1059.007 JavaScript

T1539 Steal Web Session Cookie

T1213 Data from Information Repositories

T1567 Exfiltration Over Web Service

T1491.001 Defacement