PT-2026-6678 · Tydac Ag · Tydac Ag Map+

Benjamin Faller + 1 · Published 2026-02-06 · Updated 2026-02-18 · CVE-2026-0521

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TYDAC AG MAP+ version 3.4.0

Description A reflected cross-site scripting (XSS) flaw exists in the PDF export functionality. This allows unauthenticated attackers to create a malicious URL. If a victim accesses this URL, arbitrary JavaScript code can be executed within the victim’s browsing session. The malicious URL could be delivered through methods like sending a link or tricking a victim into visiting a crafted page.

Recommendations TYDAC AG MAP+ version 3.4.0 should be updated to a fixed version. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-0521

Affected Products

Tydac Ag Map+

References · 8

• 🔥 https://redguard.ch/blog/2026/02/05/advisory-tydac-mapplus · Exploit
• https://osv.dev/vulnerability/CVE-2026-0521 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-0521 · Security Note
• https://t.me/cveNotify/152385 · Telegram Post
• https://twitter.com/CVEnew/status/2019671076142481533 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2019702890156224641 · Twitter Post
• https://twitter.com/redguard_ch/status/2020863217086439611 · Twitter Post
• https://tydac.ch/en/mapplus · Note