CVE-2025-66523
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedURL parameters are directly embedded into JavaScript code or HTML attributes without proper encoding or sanitization. This allows attackers to inject arbitrary scripts when an authenticated user visits a crafted link. This issue affects na1.foxitesign.foxit.com: before 2026‑01‑16.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · moderate confidenceThis is a reflected Cross-Site Scripting (XSS) vulnerability in the Foxit eSign web application (na1.foxitesign.foxit.com). User-supplied URL parameters are directly inserted into JavaScript code or HTML attributes without proper output encoding, allowing injection of arbitrary script tags when an authenticated user clicks a specially crafted link.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data< 2026-01-16CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- Required
- Scope
- Changed
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Confirm Foxit eSign usageIdentify if your organization uses Foxit eSign for document signing. Check for emails from @foxit.com or @foxitesign.com, or look for Foxit eSign login URLs in your bookmarks or internal documentation.Affected if Your organization uses Foxit eSign as your document signing platform
-
Identify your Foxit eSign deployment URLCheck which Foxit eSign instance you access. Look at the URL when logged in or check your browser's saved logins. Common patterns include na1.foxitesign.foxit.com, na2.foxitesign.foxit.com, or regional variants.Affected if Your deployment URL matches or falls within na1.foxitesign.foxit.com (the affected endpoint)
-
Check if you have an active authenticated sessionLog in to your Foxit eSign account through your organization's normal authentication method. Verify you have an active session by accessing a document or the dashboard.Affected if You can successfully authenticate and maintain an active session in Foxit eSign
-
Test for reflected URL parameter injectionWhile authenticated, examine URLs in Foxit eSign for query parameters (look for ?param=value patterns). Carefully test a known parameter by appending a benign test string like test123 to an existing parameter value, then check if that string appears unencoded in the page source or is reflected in the rendered output.Affected if URL parameter values are reflected back into the page HTML or JavaScript without encoding or sanitization
Your environment is affected if you use Foxit eSign on the na1.foxitesign.foxit.com endpoint and can reproduce unencoded URL parameter reflection while authenticated.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped2026-01-16
Implement contextual output encoding for all URL parameters before embedding them into HTML or JavaScript contexts. Additionally, configure Content-Security-Policy (CSP) headers to mitigate script injection risks.
Esign version released on or after 2026-01-16
- 1. Identify the current version of Foxit Esign installed on na1.foxitesign.foxit.com
- 2. Confirm the installed version is earlier than the 2026-01-16 release
- 3. Contact Foxit support or check their official download page for the Esign update released on or after 2026-01-16
- 4. Obtain the patched Esign release from official Foxit sources at www.foxit.com
- 5. Apply the upgrade following Foxit's documented upgrade procedure for Esign
- 6. Verify the upgrade was successful by checking the Esign version and confirming URL parameters are no longer reflected in unencoded form
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation4.0 h
- Implementation12.0 h
- Testing6.0 h
- Review / QA3.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $7,040.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2025-66523 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2025-66523 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data