Vulnerability · Published Feb 6, 2026 · Assigned by NCSC.ch

CVE-2026-0521Reflected Cross-Site Scripting in PDF Export Error Message

Medium 5.6

In plain English

A medium-severity cross-site scripting in MAP+ from TYDAC AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 4.0)5.6Medium

Exploit odds (30 days)0.3%top 77.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A reflected cross-site scripting (XSS) vulnerability in the PDF export functionality of the TYDAC AG MAP+ solution allows unauthenticated attackers to craft a malicious URL, that if visited by a victim, will execute arbitrary JavaScript in the victim's context. Such a URL could be delivered through various means, for instance, by sending a link or by tricking victims to visit a page crafted by the attacker. This issue was verified in MAP+: 3.4.0.

Affected products (as reported)

Vendor	Product	Versions
TYDAC AG	MAP+	see references

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

References

https://www.tydac.ch/en/mapplus/ product
https://www.redguard.ch/blog/2026/02/05/advisory-tydac-mapplus/ third-party-advisory, technical-description