PT-2025-52431 · Foxit · Pdfonline.Foxit.Com

Novee + 1 · Published 2025-12-19 · Updated 2025-12-19 · CVE-2025-66519

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions pdfonline.foxit.com (affected versions not specified)

Description A stored cross-site scripting (XSS) issue exists in the Layer Import functionality of pdfonline.foxit.com. A malicious payload can be injected into the “Create new Layer” field during layer import. The injected script is rendered into the Document Object Model (DOM) without proper sanitization, and executes when the Layers panel is accessed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-66519

Affected Products

Pdfonline.Foxit.Com

References · 7

• https://foxit.com/support/security-bulletins.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66519 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66519 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2001971947983278413 · Twitter Post
• https://t.me/CVEtracker/40257 · Telegram Post
• https://t.me/cveNotify/146304 · Telegram Post
• https://twitter.com/CVEnew/status/2002099171361493499 · Twitter Post