Skip to content
CVE PROGRAM SOURCE RECORD6.1 Medium

CVE-2026-34491

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
jci

Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site Scripting. This issue affects Metasys 14: before 14.1.5; Metasys 15: before 15.0.1.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Johnson Controls Metasys 14

Default version status: unaffected

  • 0 to < 14.1.5affected

Johnson Controls Metasys 15

Default version status: unaffected

  • 0 to < 15.0.1affected

References