CVE-2025-51966

A cross-site scripting (XSS) vulnerability exists in the PDF preview functionality of uTools thru 7.1.1

Medium · published September 2, 2025

CVSS v3.1
6.1
EPSS
0%
Percentile
15.5
In the wild
Unconfirmed
What it is

A cross-site scripting (XSS) vulnerability exists in the PDF preview functionality of uTools thru 7.1.1. When a user previews a specially crafted PDF file, embedded JavaScript code executes within the application's privileged context, potentially allowing attackers to steal sensitive data or perform unauthorized actions.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00251 · 15.5th percentile
Published
2025-09-02T00:00Z
EPSS history
Timeline
  • 02 SEP 00:00Z
    A cross-site scripting (XSS) vulnerability exists in the PDF preview functionality of uTools thru 7.1.1
    cvelistv5