XSS in Johnson Controls Fm Systems Employee
CVE-2026-34495
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls FM Systems Employee allows Stored XSS. This issue affects FM Systems Employee: before 2025.3.1.
Vulnerability class: XSS (Cross-Site Scripting)
Affected products
- Johnson Controls Fm Systems Employee — versions 0