2 lines
2.9 KiB
JSON
2 lines
2.9 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"pdfonline.foxit.com","vendor":"Foxit Software Inc.","versions":[{"status":"affected","version":"before 2026‑02‑03"}]}],"source":"14984358-7092-470d-8f34-ade47a7658a2"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:foxit:pdf_editor_cloud:*:*:*:*:*:*:*:*","matchCriteriaId":"C22F83B5-EAE7-4F85-A1DA-48617FB7E718","versionEndExcluding":"2026-02-03","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Foxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the file upload feature. A malicious username is embedded into the upload file list without proper escaping, allowing arbitrary JavaScript execution when the list is displayed.\n\nThis issue affects pdfonline.foxit.com: before 2026‑02‑03."},{"lang":"es","value":"Foxit PDF Editor Cloud (pdfonline) contiene una vulnerabilidad de cross-site scripting almacenado en la función de carga de archivos. Un nombre de usuario malicioso se incrusta en la lista de archivos cargados sin el escape adecuado, permitiendo la ejecución arbitraria de JavaScript cuando se muestra la lista.\n\nEste problema afecta a pdfonline.foxit.com: antes del 03-02-2026."}],"id":"CVE-2026-1591","lastModified":"2026-06-17T10:16:07.580","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":4.2,"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-1591","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-02-03T18:46:55.314220Z","version":"2.0.3"}}]},"published":"2026-02-03T08:16:14.900","references":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"],"url":"https://www.foxit.com/support/security-bulletins.html"}],"sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary"}]}
|