Loading vulnerability…
Reflected XSS in Foxit eSign crafted URL parameters
CVE-2025-66523 is a reflected cross-site scripting vulnerability in Foxit eSign affecting na1.foxitesign.foxit.com before 2026-01-16. The issue arises because URL parameters are embedded directly into JavaScript code or HTML attributes without proper contextual output encoding or sanitization. An attacker can craft a malicious link containing script payloads in those parameters; when an authenticated user visits the link, the payload executes in the browser within the Foxit eSign application context.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary JavaScript execution in the victim’s authenticated Foxit eSign session. This can enable session hijacking, theft of sensitive data accessible in the application context, execution of unauthorized actions as the victim, redirection to attacker-controlled content, and potential cross-domain data theft or privilege abuse depending on the victim’s permissions and browser/session context.
If you can’t patch tonight, do this now.
Until patched, reduce exposure by limiting access to the affected Foxit eSign service to trusted users and networks, warning users not to open untrusted crafted links while authenticated, and deploying compensating controls such as WAF filtering/normalization for suspicious URL parameters and common XSS payloads. Additional hardening such as stronger CSP and tighter session protections can reduce impact but does not replace patching.
Patch, then assume compromise.
Apply the Foxit vendor patch for CVE-2025-66523. The issue is reported as fixed in Foxit eSign on 2026-01-15/2026-01-16; affected deployments are versions before 2026-01-16. The underlying fix should ensure proper contextual output encoding for all URL parameter reflections into JavaScript and HTML attributes, along with improved input validation to prevent script injection.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.