CVE-2025-66502

A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Page Templates feature. A crafted payload can be stored as the template name, which is later rendered into the DOM without proper sanitization. As a result, the injected script executes each time the affected PDF is loaded.

• CWE-79

• https://www.foxit.com/support/security-bulletins.htmlVendor Advisory

Published

Dec 19, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-66497A memory corruption vulnerability exists in the 3D annotatio…7.8
• CVE-2025-66498A memory corruption vulnerability exists in the 3D annotatio…7.8
• CVE-2025-66499A heap-based buffer overflow vulnerability exists in the PDF…7.8
• CVE-2025-6650PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Infor…3.3
• CVE-2025-66500A stored cross-site scripting (XSS) vulnerability exists in …5.4
• CVE-2025-66501A stored cross-site scripting (XSS) vulnerability exists in …5.4
• CVE-2025-66503An out-of-bounds read vulnerability exists in the EMF functi…7.1
• CVE-2025-66506Fulcio is a free-to-use certificate authority for issuing co…7.5
• CVE-2025-665071Panel is an open-source, web-based control panel for Linux …7.5
• CVE-2025-665081Panel is an open-source, web-based control panel for Linux …6.5
• CVE-2025-66509LaraDashboard is an all-In-one solution to start a Laravel A…9.8
• CVE-2025-6651PDF-XChange Editor JP2 File Parsing Out-Of-Bounds Write Remo…7.8