Vulnerability-Lookup

CVE-2026-1591 (GCVE-0-2026-1591)

Vulnerability from cvelistv5 – Published: 2026-02-03 07:57 – Updated: 2026-02-03 18:47

Title

Stored XSS via Attachments Feature in https://pdfonline.foxit.com/

Summary

Foxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the file upload feature. A malicious username is embedded into the upload file list without proper escaping, allowing arbitrary JavaScript execution when the list is displayed. This issue affects pdfonline.foxit.com: before 2026‑02‑03.

Severity ?

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Assigner

Foxit

References

URL

Tags

https://www.foxit.com/support/security-bulletins.html

Impacted products

	Vendor	Product	Version
	Foxit Software Inc.	pdfonline.foxit.com	Affected: before 2026‑02‑03

Credits

Novee

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-1591",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-03T18:46:55.314220Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-03T18:47:39.727Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "pdfonline.foxit.com",
          "vendor": "Foxit Software Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "before 2026\u201102\u201103"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Novee"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eFoxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the file upload feature. A malicious username is embedded into the upload file list without proper escaping, allowing arbitrary JavaScript execution when the list is displayed.\u003c/span\u003e\n\n\u003cp\u003eThis issue affects pdfonline.foxit.com: before 2026\u201102\u201103.\u003c/p\u003e"
            }
          ],
          "value": "Foxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the file upload feature. A malicious username is embedded into the upload file list without proper escaping, allowing arbitrary JavaScript execution when the list is displayed.\n\nThis issue affects pdfonline.foxit.com: before 2026\u201102\u201103."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Potential arbitrary JavaScript execution"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-03T08:06:08.674Z",
        "orgId": "14984358-7092-470d-8f34-ade47a7658a2",
        "shortName": "Foxit"
      },
      "references": [
        {
          "url": "https://www.foxit.com/support/security-bulletins.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Stored XSS via Attachments Feature in https://pdfonline.foxit.com/",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "14984358-7092-470d-8f34-ade47a7658a2",
    "assignerShortName": "Foxit",
    "cveId": "CVE-2026-1591",
    "datePublished": "2026-02-03T07:57:27.281Z",
    "dateReserved": "2026-01-29T07:31:14.294Z",
    "dateUpdated": "2026-02-03T18:47:39.727Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-1591\",\"sourceIdentifier\":\"14984358-7092-470d-8f34-ade47a7658a2\",\"published\":\"2026-02-03T08:16:14.900\",\"lastModified\":\"2026-02-18T16:08:22.517\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Foxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the file upload feature. A malicious username is embedded into the upload file list without proper escaping, allowing arbitrary JavaScript execution when the list is displayed.\\n\\nThis issue affects pdfonline.foxit.com: before 2026\u201102\u201103.\"},{\"lang\":\"es\",\"value\":\"Foxit PDF Editor Cloud (pdfonline) contiene una vulnerabilidad de cross-site scripting almacenado en la funci\u00f3n de carga de archivos. Un nombre de usuario malicioso se incrusta en la lista de archivos cargados sin el escape adecuado, permitiendo la ejecuci\u00f3n arbitraria de JavaScript cuando se muestra la lista.\\n\\nEste problema afecta a pdfonline.foxit.com: antes del 03-02-2026.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"14984358-7092-470d-8f34-ade47a7658a2\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N\",\"baseScore\":6.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.1,\"impactScore\":4.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.3,\"impactScore\":2.7}]},\"weaknesses\":[{\"source\":\"14984358-7092-470d-8f34-ade47a7658a2\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:foxit:pdf_editor_cloud:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2026-02-03\",\"matchCriteriaId\":\"C22F83B5-EAE7-4F85-A1DA-48617FB7E718\"}]}]}],\"references\":[{\"url\":\"https://www.foxit.com/support/security-bulletins.html\",\"source\":\"14984358-7092-470d-8f34-ade47a7658a2\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-1591\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-02-03T18:46:55.314220Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-02-03T18:47:22.168Z\"}}], \"cna\": {\"title\": \"Stored XSS via Attachments Feature in https://pdfonline.foxit.com/\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Novee\"}], \"impacts\": [{\"descriptions\": [{\"lang\": \"en\", \"value\": \"Potential arbitrary JavaScript execution\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Foxit Software Inc.\", \"product\": \"pdfonline.foxit.com\", \"versions\": [{\"status\": \"affected\", \"version\": \"before 2026\\u201102\\u201103\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://www.foxit.com/support/security-bulletins.html\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.5.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Foxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the file upload feature. A malicious username is embedded into the upload file list without proper escaping, allowing arbitrary JavaScript execution when the list is displayed.\\n\\nThis issue affects pdfonline.foxit.com: before 2026\\u201102\\u201103.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eFoxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the file upload feature. A malicious username is embedded into the upload file list without proper escaping, allowing arbitrary JavaScript execution when the list is displayed.\u003c/span\u003e\\n\\n\u003cp\u003eThis issue affects pdfonline.foxit.com: before 2026\\u201102\\u201103.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"14984358-7092-470d-8f34-ade47a7658a2\", \"shortName\": \"Foxit\", \"dateUpdated\": \"2026-02-03T08:06:08.674Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-1591\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-02-03T18:47:39.727Z\", \"dateReserved\": \"2026-01-29T07:31:14.294Z\", \"assignerOrgId\": \"14984358-7092-470d-8f34-ade47a7658a2\", \"datePublished\": \"2026-02-03T07:57:27.281Z\", \"assignerShortName\": \"Foxit\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-1591

Vulnerability from fkie_nvd - Published: 2026-02-03 08:16 - Updated: 2026-02-18 16:08

Severity ?

6.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Summary

References

	URL	Tags
	14984358-7092-470d-8f34-ade47a7658a2	https://www.foxit.com/support/security-bulletins.html	Vendor Advisory

Impacted products

	Vendor	Product	Version
	foxit	pdf_editor_cloud	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:foxit:pdf_editor_cloud:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C22F83B5-EAE7-4F85-A1DA-48617FB7E718",
              "versionEndExcluding": "2026-02-03",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Foxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the file upload feature. A malicious username is embedded into the upload file list without proper escaping, allowing arbitrary JavaScript execution when the list is displayed.\n\nThis issue affects pdfonline.foxit.com: before 2026\u201102\u201103."
    },
    {
      "lang": "es",
      "value": "Foxit PDF Editor Cloud (pdfonline) contiene una vulnerabilidad de cross-site scripting almacenado en la funci\u00f3n de carga de archivos. Un nombre de usuario malicioso se incrusta en la lista de archivos cargados sin el escape adecuado, permitiendo la ejecuci\u00f3n arbitraria de JavaScript cuando se muestra la lista.\n\nEste problema afecta a pdfonline.foxit.com: antes del 03-02-2026."
    }
  ],
  "id": "CVE-2026-1591",
  "lastModified": "2026-02-18T16:08:22.517",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 4.2,
        "source": "14984358-7092-470d-8f34-ade47a7658a2",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2026-02-03T08:16:14.900",
  "references": [
    {
      "source": "14984358-7092-470d-8f34-ade47a7658a2",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.foxit.com/support/security-bulletins.html"
    }
  ],
  "sourceIdentifier": "14984358-7092-470d-8f34-ade47a7658a2",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "14984358-7092-470d-8f34-ade47a7658a2",
      "type": "Secondary"
    }
  ]
}

GHSA-G4WF-V389-9W53

Vulnerability from github – Published: 2026-02-03 09:30 – Updated: 2026-02-18 18:30

Details

This issue affects pdfonline.foxit.com: before 2026‑02‑03.

Severity ?

6.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-1591"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-03T08:16:14Z",
    "severity": "MODERATE"
  },
  "details": "Foxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the file upload feature. A malicious username is embedded into the upload file list without proper escaping, allowing arbitrary JavaScript execution when the list is displayed.\n\nThis issue affects pdfonline.foxit.com: before 2026\u201102\u201103.",
  "id": "GHSA-g4wf-v389-9w53",
  "modified": "2026-02-18T18:30:22Z",
  "published": "2026-02-03T09:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1591"
    },
    {
      "type": "WEB",
      "url": "https://www.foxit.com/support/security-bulletins.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-1591 (GCVE-0-2026-1591)

FKIE_CVE-2026-1591

GHSA-G4WF-V389-9W53

Tags

Sightings

Nomenclature