Element Maps Ng V47
Monthly
Reflected cross-site scripting in Siemens Element maps-ng allows a network-accessible attacker with low privileges to execute arbitrary JavaScript in a victim's browser session by crafting a malicious URL containing an unsanitized payload in the si-map component's points property. Affected are all V47 builds prior to V47.12.3, all V48 builds prior to V48.11.3, and all V49 builds prior to V49.16.1. Exploitation requires the victim to load the crafted URL and hover over a map pin to trigger tooltip rendering, at which point the injected script executes with full access to the victim's browser session context. No public exploit code or CISA KEV listing has been identified at time of analysis.
Reflected cross-site scripting in Siemens Element maps-ng allows a network-accessible attacker with low privileges to execute arbitrary JavaScript in a victim's browser session by crafting a malicious URL containing an unsanitized payload in the si-map component's points property. Affected are all V47 builds prior to V47.12.3, all V48 builds prior to V48.11.3, and all V49 builds prior to V49.16.1. Exploitation requires the victim to load the crafted URL and hover over a map pin to trigger tooltip rendering, at which point the injected script executes with full access to the victim's browser session context. No public exploit code or CISA KEV listing has been identified at time of analysis.