Medium · 6.1 CVE-2025-66523 EUVD-2026-3463GHSA-jv72-wxjv-h5q2

Reflected Cross-Site Scripting (XSS) Vulnerability in na1.foxitesign.foxit.com via Unsanitized URL Parameters

Published Jan 20, 2026 · Updated Jan 20, 2026 · Assigned by Foxit

Vendor: Foxit Product: na1.foxitesign.foxit.com

Description

URL parameters are directly embedded into JavaScript code or HTML attributes without proper encoding or sanitization. This allows attackers to inject arbitrary scripts when an authenticated user visits a crafted link.

This issue affects na1.foxitesign.foxit.com: before 2026‑01‑16.

Affected products

Vendor	Product	Affected	Fixed
Foxit Software	na1.foxitesign.foxit.com	before 2026‑01‑16	—

Advisories 1

WID-SEC-2026-0934 Foxit PDF Editor und Reader: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 6, 2026

References

https://www.foxit.com/support/security-bulletins.html