CVE-2025-66523CWE-79

Reflected Cross-Site Scripting (XSS) Vulnerability in na1.foxitesign.foxit.com via Unsanitized URL Parameters

Medium · published January 20, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
8.4
In the wild
Unconfirmed
What it is

URL parameters are directly embedded into JavaScript code or HTML attributes without proper encoding or sanitization. This allows attackers to inject arbitrary scripts when an authenticated user visits a crafted link.

This issue affects na1.foxitesign.foxit.com: before 2026‑01‑16.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00192 · 8.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-01-20T06:51Z
EPSS history
Timeline
  • 20 JAN 06:51Z
    Reflected Cross-Site Scripting (XSS) Vulnerability in na1.foxitesign.foxit.com via Unsanitized URL Parameters
    cvelistv5