DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Foxit PDF Editor und Reader: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-03-30
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Foxit PDF Editor und Foxit PDF Reader ausnutzen, um Informationen offenzulegen, einen Denial of Service zu verursachen oder Code auszuführen. .
01
beschreibt (11)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-4947US | — | — | ||
Addressed a potential insecure direct object reference (IDOR) vulnerability in the signing invitation acceptance process. Under certain conditions, this issue could have allowed an… | ||||
| CVE-2026-3780US | high7.8 | — | ||
The application's installer runs with elevated privileges but resolves system executables and DLLs using untrusted search paths that can include user-writable directories, allowing… | ||||
| CVE-2026-3779US | — | — | ||
The application's list box calculate array logic keeps stale references to page or form objects after they are deleted or re-created, which allows crafted documents to trigger a us… | ||||
| CVE-2026-3778US | medium5.5 | — | ||
The application does not detect or guard against cyclic PDF object references while handling JavaScript in PDF. When pages and annotations are crafted that reference each other in… | ||||
| CVE-2026-3777US | high7.8 | — | ||
The application does not properly validate the lifetime and validity of internal view cache pointers after JavaScript changes the document zoom and page state. When a script modifi… | ||||
| CVE-2026-3776US | — | — | ||
The application does not validate the presence of required appearance (AP) data before accessing stamp annotation resources. When a PDF contains a stamp annotation missing its AP e… | ||||
| CVE-2026-3775US | — | — | ||
The application's update service, when checking for updates, loads certain system libraries from a search path that includes directories writable by low‑privileged users and is not… | ||||
| CVE-2026-3774US | high7.5 | — | ||
The application allows PDF JavaScript and document/print actions (such as WillPrint/DidPrint) to update form fields, annotations, or optional content groups (OCGs) immediately befo… | ||||
| CVE-2026-1592US | medium5.4 | — | ||
Foxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the Create New Layer feature. Unsanitized user input is embedded into the HTML output, al… | ||||
| CVE-2026-1591US | medium5.4 | — | ||
Foxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the file upload feature. A malicious username is embedded into the upload file list witho… | ||||
| CVE-2025-66523US | — | — | ||
URL parameters are directly embedded into JavaScript code or HTML attributes without proper encoding or sanitization. This allows attackers to inject arbitrary scripts when an auth… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan