Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Johnson Controls FM Systems Employee 2025.3.1 Clear all filters
TI-2026-26751 CVE-2026-34497 · GHSA-9hxq-5m48-2w2f

FMS Employee Vulnerable to HTML Injection

Priority LOW 22

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Johnson Controls FM Systems Employee allows Cross-Site Scripting (XSS).

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00234 Published 2026-07-31 Fixed in 2025.3.1 CWE-80
TI-2026-26749 CVE-2026-34495 · GHSA-25v9-w9h4-jpjx

FMS Employee vulnerable to XSS

Priority LOW 22

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls FM Systems Employee allows Stored XSS.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00234 Published 2026-07-31 Fixed in 2025.3.1 CWE-79
TI-2026-17445 CVE-2026-21662 · GHSA-9m8h-rcg4-v896

FMS Employee Allows Upload of Unrestricted Files

Priority LOW 23

Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00504 Published 2026-07-31 Fixed in 2025.3.1 CWE-434