Foxit Com
Monthly
Foxit's hosted HTML-to-PDF conversion service used a shared token for submitted documents, so an unauthenticated remote attacker who obtained or reused that token could access conversions submitted by other users (CWE-639). The exposure is limited to documents processed through Foxit's online converter before the vendor's 2026-10-29 remediation, with confidentiality-only impact; no public exploit code was identified at time of analysis.
Server-side request forgery in Foxit's hosted HTML-to-PDF conversion service (foxit.com) lets remote, unauthenticated attackers bypass the service's restriction on requests to internal IP addresses by supplying ZIP-formatted input, allowing enumeration and discovery of internal network resources. The exposure is confined to Foxit's own SaaS infrastructure: the flaw does not ship in any customer-deployed product, permits no writes or disruption (the assessed vector is C:L/I:N/A:N with a scope change), and per the EUVD record was remediated server-side before 2026-10-29. No confirmed public exploit code and no CISA KEV entry were identified at time of analysis, and the vuln.today decision label is 'this_week'.
Third-party authorization credentials were embedded directly in client-side JavaScript served by the Foxit website (foxit.com), letting any visitor read them without authentication or user interaction and potentially reuse them against the third-party service they authorize. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, base 8.6 High) fits that exposure exactly, including the scope change that reflects impact landing on a separate third-party system rather than on foxit.com itself. EUVD records the affected range as foxit.com before 2026-10-29, and no public exploit code was identified at time of analysis; realistic risk depends on the privileges of the specific third-party service the leaked credentials grant, which has not been disclosed.
Foxit's hosted HTML-to-PDF conversion service used a shared token for submitted documents, so an unauthenticated remote attacker who obtained or reused that token could access conversions submitted by other users (CWE-639). The exposure is limited to documents processed through Foxit's online converter before the vendor's 2026-10-29 remediation, with confidentiality-only impact; no public exploit code was identified at time of analysis.
Server-side request forgery in Foxit's hosted HTML-to-PDF conversion service (foxit.com) lets remote, unauthenticated attackers bypass the service's restriction on requests to internal IP addresses by supplying ZIP-formatted input, allowing enumeration and discovery of internal network resources. The exposure is confined to Foxit's own SaaS infrastructure: the flaw does not ship in any customer-deployed product, permits no writes or disruption (the assessed vector is C:L/I:N/A:N with a scope change), and per the EUVD record was remediated server-side before 2026-10-29. No confirmed public exploit code and no CISA KEV entry were identified at time of analysis, and the vuln.today decision label is 'this_week'.
Third-party authorization credentials were embedded directly in client-side JavaScript served by the Foxit website (foxit.com), letting any visitor read them without authentication or user interaction and potentially reuse them against the third-party service they authorize. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, base 8.6 High) fits that exposure exactly, including the scope change that reflects impact landing on a separate third-party system rather than on foxit.com itself. EUVD records the affected range as foxit.com before 2026-10-29, and no public exploit code was identified at time of analysis; realistic risk depends on the privileges of the specific third-party service the leaked credentials grant, which has not been disclosed.