CVE-2026-47106: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Ellucian Banner Self-Service
Ellucian Banner Self-Service before the April T2 release (2025-04-23) contains a stored cross-site scripting vulnerability in the course search functionality that allows authenticated Banner ERP users to inject malicious payloads into faculty and course fields by exploiting missing HTML encoding during DOM insertion. An attacker with Banner ERP write access can store malicious JavaScript in fields such as faculty displayName, emailAddress, subjectDescription, or courseTitle; these values are subsequently served unsanitized by the unauthenticated getFacultyMeetingTimes API endpoint, causing arbitrary script execution in the browser of any user who views the affected course's meeting times.
AI Analysis
Technical Summary
Ellucian Banner Self-Service before the April T2 release (2025-04-23) contains a stored cross-site scripting vulnerability in the course search functionality. Authenticated users with write access to Banner ERP can inject malicious JavaScript into fields such as faculty displayName, emailAddress, subjectDescription, or courseTitle. These fields are then served without proper HTML encoding by the unauthenticated getFacultyMeetingTimes API endpoint, enabling arbitrary script execution in the browsers of any users who access the affected course meeting times. This vulnerability arises from improper neutralization of input during web page generation.
Potential Impact
An attacker with write access to Banner ERP can store malicious scripts in certain faculty and course fields. Because these fields are served unsanitized by an unauthenticated API, any user viewing the affected course meeting times can have arbitrary JavaScript executed in their browser. This can lead to session hijacking, unauthorized actions, or other client-side attacks. The vulnerability affects confidentiality and integrity of user sessions but requires authenticated write access to inject payloads.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is documented in the provided data. Until a patch is available, restrict write access to Banner ERP users to trusted personnel only and monitor for suspicious activity related to course and faculty data inputs.
CVE-2026-47106: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Ellucian Banner Self-Service
Description
Ellucian Banner Self-Service before the April T2 release (2025-04-23) contains a stored cross-site scripting vulnerability in the course search functionality that allows authenticated Banner ERP users to inject malicious payloads into faculty and course fields by exploiting missing HTML encoding during DOM insertion. An attacker with Banner ERP write access can store malicious JavaScript in fields such as faculty displayName, emailAddress, subjectDescription, or courseTitle; these values are subsequently served unsanitized by the unauthenticated getFacultyMeetingTimes API endpoint, causing arbitrary script execution in the browser of any user who views the affected course's meeting times.
CVSS v4.0
Score 5.1medium
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Ellucian Banner Self-Service before the April T2 release (2025-04-23) contains a stored cross-site scripting vulnerability in the course search functionality. Authenticated users with write access to Banner ERP can inject malicious JavaScript into fields such as faculty displayName, emailAddress, subjectDescription, or courseTitle. These fields are then served without proper HTML encoding by the unauthenticated getFacultyMeetingTimes API endpoint, enabling arbitrary script execution in the browsers of any users who access the affected course meeting times. This vulnerability arises from improper neutralization of input during web page generation.
Potential Impact
An attacker with write access to Banner ERP can store malicious scripts in certain faculty and course fields. Because these fields are served unsanitized by an unauthenticated API, any user viewing the affected course meeting times can have arbitrary JavaScript executed in their browser. This can lead to session hijacking, unauthorized actions, or other client-side attacks. The vulnerability affects confidentiality and integrity of user sessions but requires authenticated write access to inject payloads.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is documented in the provided data. Until a patch is available, restrict write access to Banner ERP users to trusted personnel only and monitor for suspicious activity related to course and faculty data inputs.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-05-18T19:22:26.748Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a286c5b8dd33fbd857433ae
Added to database: 06/09/2026, 19:41:15 UTC
Last enriched: 07/15/2026, 10:03:55 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 41
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.