Loading vulnerability…
Stored XSS in Foxit PDF Online Trusted Certificates (certificate name)
A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Trusted Certificates feature. An attacker can inject a crafted JavaScript payload into the certificate name field; the application later renders this value into the DOM without proper sanitization/encoding. The malicious script then executes whenever the Trusted Certificates view is loaded, making the XSS persistent for any user/session that loads the affected view.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Persistent client-side script execution in the context of pdfonline.foxit.com when the Trusted Certificates view is opened. This can enable session/token theft, account actions as the victim, UI redress/phishing within the trusted origin, and broader compromise of user data accessible to the web application.
If you can’t patch tonight, do this now.
Until patched: restrict access to the Trusted Certificates management feature to trusted administrators, monitor for suspicious certificate-name values, and deploy/strengthen CSP (disallow inline script, restrict script-src to trusted origins) to limit exploitability. Consider additional client-side hardening to prevent unsafe DOM insertion of untrusted fields.
Patch, then assume compromise.
Apply the vendor patch/mitigation coordinated via responsible disclosure. Ensure the certificate name is properly output-encoded for the target context (HTML/attribute/JS) before insertion into the DOM, and avoid unsafe DOM sinks (e.g., innerHTML/dangerouslySetInnerHTML) for untrusted data. Add server-side validation to reject/normalize dangerous characters and enforce a strict Content Security Policy (CSP) to reduce XSS impact.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.