CVE-2025-66522

Foxit pdfonline.foxit.com Stored Cross-Site Scripting in Digital IDs Common Name Field

State: Published
Severity: 6.3 Medium
Published: Dec 19, 2025
Updated: Dec 19, 2025
Reserved: Dec 4, 2025

Description

A stored cross-site scripting (XSS) vulnerability exists in the Digital IDs functionality of the Foxit PDF Editor Cloud (pdfonline.foxit.com). The application does not properly sanitize or encode the Common Name field of Digital IDs before inserting user-supplied content into the DOM. As a result, embedded HTML or JavaScript may execute whenever the Digital IDs dialog is accessed or when the affected PDF is loaded.

Scores

CVSS	Score	Vector	Source
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N	Foxit

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Affected Products

Product	Versions
pdfonline.foxit.comFoxit Software Inc.	before 2025‑12‑01Affected

References

https://www.foxit.com/support/security-bulletins.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.