CVE-2025-66519

MediumCVSS 6.3

Published: 19/12/2025(UTC)Updated: 30/09/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Layer Import functionality. A crafted payload injected into the “Create new Layer” field during layer import is rendered into the DOM without proper sanitization, causing the injected script to execute when the Layers panel is accessed.

Risk Assessment

An attacker can execute arbitrary JavaScript in the context of a user's session when they view the layers panel, potentially leading to session data theft or account takeover.

Recommendation

Avoid importing layers from untrusted sources until Foxit releases a fix, and report the issue to the vendor if it has not yet been addressed.

Other vulnerabilities in pdfonline.foxit.com

CVE-2025-66502Medium
A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Page Templates feature. A crafted payload can be stored as the template name and is rendered into the DOM without proper sanitization, causing the injected script to execute each time the affected PDF is loaded.

Original NVD description (English source)

A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Layer Import functionality. A crafted payload can be injected into the “Create new Layer” field during layer import and is later rendered into the DOM without proper sanitization. As a result, the injected script executes when the Layers panel is accessed.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS