Live › vulnerability › CVE-2026-111419
A hardcoded API token in JavaScript on Foxit's website let anyone reading the page source submit fake user-behavior data and skew Foxit's statistics. Foxit says it is fixed server-side, with no customer action required.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 10:24 UTC. All times on this page are UTC.
Only Foxit itself: the token was in the foxit.com website JavaScript and could be used to submit fake user-behavior data, corrupting analytics. Foxit PDF Reader/Editor users and Foxit customers can skip it. If you embed a similar token in front-end JavaScript on your own site, treat it as public and rotate it.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A sensitive information exposure vulnerability exists on the Foxit official website because JavaScript code contains third-party authorization information. This may allow unauthorized parties to obtain or misuse the exposed credentials.
This page as .md · .json · in your agent: get_signal("CVE-2026-111419")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.