CVE-2026-65450 is an SQL Injection vulnerability (CWE-89) in RomanCode MapSVG versions up to 8.14.0. The vulnerability arises from improper neutralization of special elements used in SQL commands within the Contributor feature. The CVSS 3.1 base score is 8.5, indicating high severity, with network attack vector, low attack complexity, requiring low privileges and no user interaction. The impact scope is changed (S:C), affecting confidentiality with high impact, no integrity impact, and low availability impact. No patch or official remediation level has been published as of the vulnerability disclosure date.

Successful exploitation can lead to unauthorized disclosure of sensitive information (high confidentiality impact) and partial denial of service (low availability impact). The vulnerability does not impact data integrity. The attack can be performed remotely over the network with low complexity and requires only low privileges, without user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the Contributor functionality and monitor for unusual activity related to SQL queries. Avoid exposing vulnerable versions publicly if possible.