The flaw is a reflected cross‑site scripting vulnerability in the PDF export endpoint of TYDAC AG MAP+. The endpoint’s error response reflects user‑supplied input without proper encoding, allowing an attacker to embed malicious JavaScript in a URL that, when visited by a user, runs in the victim’s browser context. This can lead to session hijacking, defacement, or execution of further malicious actions within the victim’s session. The weakness is a classic reflected XSS, classified as CWE‑79.

TYDAC AG MAP+ versions 3.4.0 is confirmed vulnerable. No other versions were explicitly listed in the advisory, so only this release should be considered affected for now.

The CVSS base score of 5.6 reflects moderate impact, primarily because exploitation requires the victim to click a malicious link. The EPSS score of less than 1% indicates a low likelihood of widespread exploitation at this time. The issue is not listed in the CISA KEV catalog. Exploitation is possible without authentication; an attacker simply distributes a crafted link via phishing, social engineering, or embedding in a victim‑targeted page. The impact is limited to the victim’s browser session and any data accessed within that session.