Intel

CVE-2026-66155

Siemens ProductCERT Advisory SSA-682041

highEPSS 0.3%

Description

A vulnerability has been identified in Element maps-ng V47 (All versions < V47.12.3), Element maps-ng V48 (All versions < V48.11.3), Element maps-ng V49 (All versions < V49.16.1). The si-map component does not properly neutralize user-controllable input of the points property that is used to render the tooltip label of map pins. This could allow an attacker to craft a malicious URL that, when loaded by a victim and the map pin is hovered over, executes arbitrary script code within the victim's browser session.

Source: NVD (NIST)siemens_advisorycvelistv5

Metrics

XIEM Effective CVSS
7.6
Source: nvd-v3
EPSS percentile
19.3 %
Elevated — this CVE ranks above at least 10% of all CVEs scored today.
KEV status
—
Show all metrics
Severity
high
Priority score
68.23
Exploit maturity
no public PoC known
CVSS v3
7.6
CVSS v4
7.0
EPSS score
0.3 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-08-27 13:18 UTC
CWE
CWE-79

Weakness classes (CWE)

  • CWE-79Base

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

    cwe.mitre.org →

References & sources

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. New CVE Received2026-08-27 13:18 UTC· productcert@siemens.com
    • Description: A vulnerability has been identified in Element maps-ng V47 (All versions < V47.12.3), Element maps-ng V48 (All versions < V48.11.3), Element maps-ng V49 (All versions < V49.16.1). The si-map component does not properly neutralize user-controllable input of the points property that is used to render the tooltip label of map pins. This could allow an attacker to craft a malicious URL that, when loaded by a victim and the map pin is hovered over, executes arbitrary script code within the victim's browser session.
    • CVSS V4.0: AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
    • CVSS V3.1: AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
    • CWE: CWE-79