CVE-2025-66523
Unknown
Unknown - Not Provided
Cross-Site Scripting in Foxit Sign URL Parameters Allows Script Injection
Publication date: 2026-01-20
Last updated on: 2026-04-09
Assigner: Foxit
Description
Description
URL parameters are directly embedded into JavaScript code or HTML attributes without proper encoding or sanitization. This allows attackers to inject arbitrary scripts when an authenticated user visits a crafted link.
This issue affects na1.foxitesign.foxit.com: before 2026‑01‑16.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| foxit | esign | to 2026-01-16 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs because URL parameters are directly embedded into JavaScript code or HTML attributes without proper encoding or sanitization. This flaw allows attackers to inject arbitrary scripts that execute when an authenticated user visits a specially crafted link.
How can this vulnerability impact me? :
The vulnerability can lead to attackers executing arbitrary scripts in the context of an authenticated user, potentially leading to unauthorized actions, data theft, or session hijacking.
Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70