BaseFortify

Publication date: 2025-12-19

Last updated on: 2025-12-23

Assigner: Foxit

Description

A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Trusted Certificates feature. A crafted payload can be injected as the certificate name, which is later rendered into the DOM without proper sanitization. As a result, the injected script executes each time the Trusted Certificates view is loaded.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-19

Last Modified

2025-12-23

Generated

2026-07-06

AI Q&A

2025-12-19

EPSS Evaluated

2026-07-05

NVD

CVE-2025-66521

EUVD

EUVD-2025-204455

Affected Vendors & Products

Vendor	Product	Version / Range
foxit	pdf_editor_cloud	to 2025-12-01 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) issue in the Trusted Certificates feature of pdfonline.foxit.com. An attacker can inject a malicious script by crafting a payload as the certificate name. This script is then stored and executed every time the Trusted Certificates view is loaded because the input is not properly sanitized before being rendered in the DOM.

Impact Analysis

The vulnerability can lead to the execution of malicious scripts in the context of the user's browser when viewing the Trusted Certificates. This can result in unauthorized actions such as stealing sensitive information, session hijacking, or performing actions on behalf of the user without their consent.

Hi! I’m here to help you understand CVE-2025-66521. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70