CVE-2026-66449 describes an unauthenticated Cross Site Scripting (XSS) vulnerability in Geo Mashup software versions up to 1.13.18. The vulnerability allows remote attackers to inject malicious scripts without requiring authentication. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low attack complexity and no privileges required, but user interaction is needed. The vulnerability impacts confidentiality, integrity, and availability with a high severity rating.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially resulting in data theft, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability of user data. Since the vulnerability is unauthenticated, any remote attacker can attempt exploitation without prior access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying web application firewalls or input validation controls to mitigate XSS risks. Monitor vendor channels for updates and apply patches promptly once released.