medium6.1
CVE-2026-34491
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys …
Impact
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site Scripting. This issue affects Metasys 14: before 14.1.5; Metasys 15: before 15.0.1.
Affected products
| Product | Affected versions |
|---|---|
| Metasys 14 | before 14.1.5 |
Versions were read from the advisory text. No structured product data has been published for this record yet.