Skip to content
CVE PROGRAM SOURCE RECORD7.0 High

CVE-2026-66155

A vulnerability has been identified in Element maps-ng V47 (All versions < V47.12.3), Element maps-ng V48 (All versions < V48.11.3), Element maps-ng V49 (All versions < V49.16.1).

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
siemens

Description

A vulnerability has been identified in Element maps-ng V47 (All versions < V47.12.3), Element maps-ng V48 (All versions < V48.11.3), Element maps-ng V49 (All versions < V49.16.1). The si-map component does not properly neutralize user-controllable input of the points property that is used to render the tooltip label of map pins. This could allow an attacker to craft a malicious URL that, when loaded by a victim and the map pin is hovered over, executes arbitrary script code within the victim's browser session.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Siemens Element maps-ng V47

Default version status: unknown

  • 0 to < V47.12.3affected

Siemens Element maps-ng V48

Default version status: unknown

  • 0 to < V48.11.3affected

Siemens Element maps-ng V49

Default version status: unknown

  • 0 to < V49.16.1affected

References