high7.8Public exploit code
CVE-2020-14425
Foxit Reader before 10.0 allows Remote Command Execution via the app.opencPDFWebPage JavsScript API.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Foxit Reader 9.7.1 - Remote Command Execution (Javascript API)2020-11-02 · local · windows · Verified
Impact
Foxit Reader before 10.0 allows Remote Command Execution via the app.opencPDFWebPage JavsScript API. An attacker can execute local files and bypass the security dialog.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Foxitsoftware | Foxit Reader | from 9.7.1 before 10.0.0 |
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/159784/Foxit-Reader-9.7.1-Remote-Command-Execution.html
- https://www.exploit-db.com/exploits/48982
- https://www.foxitsoftware.com/support/security-bulletins.php
- http://packetstormsecurity.com/files/159784/Foxit-Reader-9.7.1-Remote-Command-Execution.html
- https://www.exploit-db.com/exploits/48982
- https://www.foxitsoftware.com/support/security-bulletins.php