This could allow an attacker to craft a malicious URL that, when loaded by a victim and the map pin is hovered over, executes arbitrary script code within the victim's browser session.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Siemens | Element maps-ng V47 | unknown |
|
||||||
| Siemens | Element maps-ng V48 | unknown |
|
||||||
| Siemens | Element maps-ng V49 | unknown |
|
No data.
No data.
No data.
Project Subscriptions
No data.
No advisories yet.
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Thu, 27 Aug 2026 13:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A vulnerability has been identified in Element maps-ng V47 (All versions < V47.12.3), Element maps-ng V48 (All versions < V48.11.3), Element maps-ng V49 (All versions < V49.16.1). The si-map component does not properly neutralize user-controllable input of the points property that is used to render the tooltip label of map pins. This could allow an attacker to craft a malicious URL that, when loaded by a victim and the map pin is hovered over, executes arbitrary script code within the victim's browser session. | |
| Weaknesses | CWE-79 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: siemens
Published:
Updated: 2026-08-27T11:56:48.418Z
Reserved: 2026-07-24T09:01:24.331Z
Link: CVE-2026-66155
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-08-27T13:18:31.090
Modified: 2026-08-27T13:18:31.090
Link: CVE-2026-66155
Redhat
No data.
OpenCVE Enrichment
No data.