Loading vulnerability…
Stored XSS in Foxit PDF Editor Cloud Digital IDs Common Name
A stored cross-site scripting (XSS) vulnerability exists in the Digital IDs functionality of Foxit PDF Editor Cloud (pdfonline.foxit.com). The application fails to properly sanitize and/or output-encode the user-controlled Digital ID “Common Name” field before inserting it into the DOM. An attacker can store HTML/JavaScript payloads in the Common Name such that the payload executes when the Digital IDs dialog is accessed and/or when an affected PDF is loaded, resulting in script execution in the context of the Foxit PDF Editor Cloud origin.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation results in arbitrary JavaScript execution in the victim’s browser within the security context of pdfonline.foxit.com when the stored payload is rendered. This can enable session/token theft, account actions as the victim, data exfiltration from the application context, and other web-impact outcomes consistent with stored XSS.
If you can’t patch tonight, do this now.
Not available from provided content.
Patch, then assume compromise.
Not available from provided content.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.