Threat database

Ellucian WebAdvisor 3.2 has an unauthenticated XML External Entity (XXE) injection vulnerability in its /WebAdvisor/WebAdvisor endpoint. This flaw allows remote attackers to submit crafted XML POST requests that do not disable external entity and DTD resolution. Exploitation can lead to server-side request forgery (SSRF), disclosure of NTLMv2 hashes via attacker-controlled SMB shares, and reading arbitrary files from the Windows host through out-of-band error channels. WebAdvisor 3.2 reached end-of-support in June 2022, and users are advised to migrate to Colleague Self-Service.

CVE-2026-6881 is a critical SQL Injection vulnerability in the Giving Reports functionality of Ellucian Advance Web and Legacy Advance. An authenticated attacker can exploit this flaw by injecting crafted SQL queries into the class credit field to extract sensitive database information. Ellucian CRM Advance is not affected by this issue. No patch or official remediation guidance has been provided yet.

Ellucian Banner Self-Service before the April T2 release (2025-04-23) contains a stored cross-site scripting vulnerability in the course search functionality that allows authenticated Banner ERP users to inject malicious payloads into faculty and course fields by exploiting missing HTML encoding during DOM insertion. An attacker with Banner ERP write access can store malicious JavaScript in fields such as faculty displayName, emailAddress, subjectDescription, or courseTitle; these values are subsequently served unsanitized by the unauthenticated getFacultyMeetingTimes API endpoint, causing arbitrary script execution in the browser of any user who views the affected course's meeting times.

Ellucian Banner Self-Service before the April T2 release (2025-04-23) contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by injecting unsanitized input through the toDateFormat request parameter in the dateConverter endpoint. Attackers can craft a malicious URL targeting the unauthenticated dateConverter endpoint to steal session cookies or perform other malicious actions in the context of the victim's browser session.