CVE-2020-14425 – Foxit Reader before 10.0 allows Remote Command Execution via the app.open

Foxit Reader before 10.0 allows Remote Command Execution via the app.opencPDFWebPage JavsScript API. An attacker can execute local files and bypass the security dialog.

Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14425

Reference (s):

• http://packetstormsecurity.com/files/159784/Foxit-Reader-9.7.1-Remote-Command-Execution.html
• https://www.exploit-db.com/exploits/48982
• https://www.foxitsoftware.com/support/security-bulletins.php