URL parameters are directly embedded into JavaScript code or HTML attributes without proper encoding or sanitization. This allows attackers to inject arbitrary scripts when an authenticated user visits a crafted link.
This issue affects na1.foxitesign.foxit.com: before 2026‑01‑16.
This issue affects na1.foxitesign.foxit.com: before 2026‑01‑16.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
| Link | Providers |
|---|---|
| https://www.foxit.com/support/security-bulletins.html |
|
History
Tue, 20 Jan 2026 07:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | URL parameters are directly embedded into JavaScript code or HTML attributes without proper encoding or sanitization. This allows attackers to inject arbitrary scripts when an authenticated user visits a crafted link. This issue affects na1.foxitesign.foxit.com: before 2026‑01‑16. | |
| Title | Reflected Cross-Site Scripting (XSS) Vulnerability in na1.foxitesign.foxit.com via Unsanitized URL Parameters | |
| Weaknesses | CWE-79 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Foxit
Published:
Updated: 2026-01-20T06:51:34.771Z
Reserved: 2025-12-04T03:37:51.889Z
Link: CVE-2025-66523
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-01-20T07:15:48.490
Modified: 2026-01-20T07:15:48.490
Link: CVE-2025-66523
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses