CVE-2026-34497
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
In Johnson Controls FM Systems Employee before version 2025.3.1, there is a basic XSS vulnerability due to improper neutralization of script-related HTML tags in a web page.
Risk Assessment
An attacker can inject a malicious script that executes in the victim's browser, leading to data theft or session hijacking.
Recommendation
Update FM Systems Employee to version 2025.3.1 or later.
Other vulnerabilities in Johnson Controls FM Systems Employee
See all- CVE-2026-21662Critical
In Johnson Controls FM Systems Employee before version 2025.3.1, there is an unrestricted upload of file with dangerous type vulnerability, allowing the use of malicious files.
- CVE-2026-34495Medium
In Johnson Controls FM Systems Employee before version 2025.3.1, there is a Stored XSS vulnerability due to improper neutralization of input during web page generation.
Original NVD description (English source)
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Johnson Controls FM Systems Employee allows Cross-Site Scripting (XSS). This issue affects FM Systems Employee: before 2025.3.1.