This vulnerability (CVE-2024-47096) is classified as CWE-79, indicating improper neutralization of input leading to Cross-Site Scripting (XSS). Specifically, in Follet School Solutions Destiny prior to version 22.0.1 AU1, the showSupportExpiredMessage parameter in the handleloginform.do page does not properly sanitize input, allowing remote attackers to inject and execute arbitrary client-side scripts. The CVSS 4.0 base score is 5.1, reflecting a medium severity with network attack vector, no privileges required, and user interaction needed. The vulnerability affects on-premises deployments (not cloud service). No official patch or vendor remediation level has been published yet.

Successful exploitation could allow an attacker to execute arbitrary client-side code in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side attacks. However, exploitation requires user interaction and no privileges or authentication are needed. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider restricting access to the vulnerable endpoint or applying input validation controls if possible. Monitor vendor communications for updates on patches or mitigations.