CVE-2026-34497 — FMS Employee Vulnerable to HTML Injection

CVE-2026-34497

FMS Employee Vulnerable to HTML Injection PUBLISHED

Description (CNA)

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Johnson Controls FM Systems Employee allows Cross-Site Scripting (XSS). This issue affects FM Systems Employee: before 2025.3.1.

Affected (CNA)

Vendor / product	Versions
Johnson Controls / FM Systems Employee	affected 0 before 2025.3.1

CWE

CWE-80

References

https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.