CVE-2026-34495
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
In Johnson Controls FM Systems Employee before version 2025.3.1, there is a Stored XSS vulnerability due to improper neutralization of input during web page generation.
Risk Assessment
An attacker can store a malicious script in the system that executes in other users' browsers, leading to data theft or session hijacking.
Recommendation
Update FM Systems Employee to version 2025.3.1 or later.
Other vulnerabilities in Johnson Controls FM Systems Employee
See all- CVE-2026-21662Critical
In Johnson Controls FM Systems Employee before version 2025.3.1, there is an unrestricted upload of file with dangerous type vulnerability, allowing the use of malicious files.
- CVE-2026-34497Medium
In Johnson Controls FM Systems Employee before version 2025.3.1, there is a basic XSS vulnerability due to improper neutralization of script-related HTML tags in a web page.
Original NVD description (English source)
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls FM Systems Employee allows Stored XSS. This issue affects FM Systems Employee: before 2025.3.1.