CVE-2025-66522CWE-79

Foxit pdfonline.foxit.com Stored Cross-Site Scripting in Digital IDs Common Name Field

Medium · published December 19, 2025

CVSS v3.1
6.3
EPSS
0%
Percentile
7.1
In the wild
Unconfirmed
What it is

A stored cross-site scripting (XSS) vulnerability exists in the Digital IDs functionality of the Foxit PDF Editor Cloud (pdfonline.foxit.com). The application does not properly sanitize or encode the Common Name field of Digital IDs before inserting user-supplied content into the DOM. As a result, embedded HTML or JavaScript may execute whenever the Digital IDs dialog is accessed or when the affected PDF is loaded.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00179 · 7.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-12-19T07:34Z
EPSS history
Timeline
  • 19 DEC 07:34Z
    Foxit pdfonline.foxit.com Stored Cross-Site Scripting in Digital IDs Common Name Field
    cvelistv5