CVE-2026-47106
Ellucian Banner Self-Service Stored XSS via getFacultyMeetingTimes API
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
Ellucian Banner Self-Service before the April T2 release (2025-04-23) contains a stored cross-site scripting vulnerability in the course search functionality that allows authenticated Banner ERP users to inject malicious payloads into faculty and course fields by exploiting missing HTML encoding during DOM insertion. Attackers can store malicious JavaScript in fields such as faculty displayName, emailAddress, subjectDescription, or courseTitle through the unauthenticated getFacultyMeetingTimes API endpoint, causing arbitrary script execution.
| CWE | CWE-79 |
| Vendor | ellucian |
| Product | banner self-service |
| Published | Jun 9, 2026 |
| Last Updated | Jun 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for ellucian banner self-service
Be the first to know when new medium vulnerabilities affecting ellucian banner self-service are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
Ellucian / Banner Self-Service
0 < April T2 9.41
References
ellucian.com: https://www.ellucian.com/security-researcher-hall-of-fame ellucian.com: https://www.ellucian.com/assets/en/brochure/brochure-learn-more-about-ellucian-banner-self-service.pdf vulncheck.com: https://www.vulncheck.com/advisories/ellucian-banner-self-service-stored-xss-via-getfacultymeetingtimes-api
Credits
Abdullah M. Alotaibi