CVE-2021-45979

CVE-2021-45979 affects Foxit PDF Reader and PDF Editor on macOS prior to 11.1. The issue allows an attacker to execute arbitrary code via the JavaScript API function app.launchURL, enabling remote code execution if a user opens a malicious document or triggers the affected API. The connected sour...

PT-2022-12480

Name of the Vulnerable Software and Affected Versions Foxit PDF Reader and PDF Editor versions prior to 11.1 Description The issue allows remote attackers to execute arbitrary code via app.launchURL in the JavaScript API. This can be exploited to gain unauthorized access and control over the...

PT-2022-12481

Name of the Vulnerable Software and Affected Versions Foxit PDF Reader and PDF Editor versions prior to 11.1 Description The issue allows remote attackers to execute arbitrary code via getURL in the JavaScript API. This can be exploited to gain unauthorized access and control over the system...

CVE-2021-45980: Undefined Security Weakness

Foxit PDF Reader and PDF Editor before 11.1 on macOS allow remote attackers to execute arbitrary code via getURL in the JavaScript API...

CVE-2021-45979: Improper Neutralization of Special Elements used in an OS Command

Foxit PDF Reader and PDF Editor before 11.1 on macOS allow remote attackers to execute arbitrary code via app.launchURL in the JavaScript API...

PT-2021-17490

Name of the Vulnerable Software and Affected Versions Foxit PDF SDK For Web versions prior to 7.5.1 is not specified, however, Foxit PDF SDK For Web through 7.5.0 is mentioned as vulnerable. Foxit PDF SDK For Web versions through 7.5.0 Description The issue allows for arbitrary JavaScript code...

CVE-2021-27517: Improper Neutralization of Input During Web Page Generation

Foxit PDF SDK For Web through 7.5.0 allows XSS. There is arbitrary JavaScript code execution in the browser if a victim uploads a malicious PDF document containing embedded JavaScript code that abuses app.alert in the Acrobat JavaScript API...

How Enigmo Moved Logic from Client to Origin to Edge

By: Hideki Ito Enigmo owns BUYMA, a Japanese fashion C2C marketplace that helps people buy and sell high-quality goods from overseas on www.buyma.com. BUYMA has 8.21 million members and deals with 5.62 million items across 140,000 fashion brands. Its website uses EdgeWorkers to manipulate cookies...

Foxit Reader Command Injection Vulnerability

Foxit is a professional electronic document technology solutions provider. Foxit Reader, one of Foxit's outstanding products, is currently one of the most popular PDF readers worldwide. A command injection vulnerability exists in the app.opencPDFWebPage JavsScript API product in Foxit Reader, whi...

CVE-2020-14425

Foxit Reader before 10.0 allows Remote Command Execution via the app.opencPDFWebPage JavsScript API. An attacker can execute local files and bypass the security dialog...

CVE-2020-14425

Foxit Reader before 10.0 allows Remote Command Execution via the app.opencPDFWebPage JavsScript API. An attacker can execute local files and bypass the security dialog...

Foxit Reader 9.7.1 - Remote Command Execution (Javascript API) Exploit

Exploit Title: Foxit Reader 9.7.1 - Remote Command Execution Javascript API Exploit Author: Nassim Asrir Vendor Homepage: https://www.foxitsoftware.com/ Description: Foxit Reader before 10.0 allows Remote Command Execution via the unsafe app.opencPDFWebPage JavaScript API which allows an attacker...

Foxit Reader 9.7.1 - Remote Command Execution (Javascript API) Exploit

Exploit Title: Foxit Reader 9.7.1 - Remote Command Execution Javascript API Exploit Author: Nassim Asrir Vendor Homepage: https://www.foxitsoftware.com/ Description: Foxit Reader before 10.0 allows Remote Command Execution via the unsafe app.opencPDFWebPage JavaScript API which allows an attacker...

PT-2020-13998

Name of the Vulnerable Software and Affected Versions Foxit Reader versions prior to 10.0 Description The issue allows for remote command execution via the app.opencPDFWebPage JavaScript API, enabling an attacker to execute local files and bypass the security dialog. Recommendations For Foxit...

CVE-2020-14425: Undefined Security Weakness

Foxit Reader before 10.0 allows Remote Command Execution via the app.opencPDFWebPage JavsScript API. An attacker can execute local files and bypass the security dialog...

Foxit Reader 9.7.1 - Remote Command Execution (Javascript API)

Exploit Title: Foxit Reader 9.7.1 - Remote Command Execution Javascript API Exploit Author: Nassim Asrir Vendor Homepage: https://www.foxitsoftware.com/ Description: Foxit Reader before 10.0 allows Remote Command Execution via the unsafe app.opencPDFWebPage JavaScript API which allows an attacker...

Foxit Reader 9.7.1 Remote Command Execution

Exploit Title: Foxit Reader 9.7.1 - Remote Command Execution Javascript API Exploit Author: Nassim Asrir CVE: CVE-2020-14425. Vendor Homepage: https://www.foxitsoftware.com/ Description: Foxit Reader before 10.0 allows Remote Command Execution via the unsafe app.opencPDFWebPage JavaScript AP whic...

CVE-2020-15179

The ScratchSig extension for MediaWiki before version 1.0.1 allows stored Cross-Site Scripting. Using tag inside tag, attackers with edit permission can execute scripts on visitors' browser. With MediaWiki JavaScript API, this can potentially lead to privilege escalation and/or account takeover...

CVE-2020-15179

The ScratchSig extension for MediaWiki before version 1.0.1 allows stored Cross-Site Scripting. Using tag inside tag, attackers with edit permission can execute scripts on visitors' browser. With MediaWiki JavaScript API, this can potentially lead to privilege escalation and/or account takeover...

Cross site scripting

The ScratchSig extension for MediaWiki before version 1.0.1 allows stored Cross-Site Scripting. Using tag inside tag, attackers with edit permission can execute scripts on visitors' browser. With MediaWiki JavaScript API, this can potentially lead to privilege escalation and/or account takeover...