VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 19, 2025· Updated Dec 19, 2025

Foxit pdfonline.foxit.com Stored Cross-Site Scripting in Portfolio SVG Handling

CVE-2025-66520

Description

A stored cross-site scripting (XSS) vulnerability exists in the Portfolio feature of the Foxit PDF Editor cloud (pdfonline.foxit.com). User-supplied SVG files are not properly sanitized or validated before being inserted into the HTML structure. As a result, embedded HTML or JavaScript within a crafted SVG may execute whenever the Portfolio file list is rendered.

Affected products

2
  • Foxit/Pdf Editorllm-fuzzy
  • Foxit Software Inc./pdfonline.foxit.comv5
    Range: before 2025‑12‑01

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

1

News mentions

0

No linked articles in our index yet.