CVE-2025-55310

HighCVSS 7.3/10Last modified Oct 14, 2026

Description

An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. An attacker able to alter or replace the static HTML files used by the StartPage feature can cause the application to load malicious or compromised content upon startup. This may result in information disclosure, unauthorized data access, or other security impacts.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-494

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.foxit.com/support/security-bulletins.htmlVendor Advisory

Timeline

Published: Dec 11, 2025
Last modified: Oct 14, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-553116.5An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. A crafted PDF can use JavaScript t CVE-2025-553127.8An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2. When pages in a PDF are deleted via JavaScri CVE-2025-553137.8An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. They allow potential arbitrary cod CVE-2025-553147.8An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. When pages in a PDF are deleted vi CVE-2025-553159.9Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a s CVE-2025-553167.8External control of file name or path in Azure Arc allows an authorized attacker to elevate privileges locally.CVE-2025-553177.8Improper link resolution before file access ('link following') in Microsoft AutoUpdate (MAU) allows an authorized attacker to elevate privil CVE-2025-553199.8Ai command injection in Agentic AI and Visual Studio Code allows an unauthorized attacker to execute code over a network.CVE-2025-55326.4The Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scrip CVE-2025-553206.8Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized CVE-2025-553219.3Improper neutralization of input during web page generation ('cross-site scripting') in Azure Monitor allows an unauthorized attacker to per CVE-2025-553227.3Binding to an unrestricted ip address in GitHub allows an unauthorized attacker to execute code over a network.