Priority MEDIUM 44
Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection vulnerability that allows remote attackers to submit crafted XML POST requests to the /WebAdvisor/WebAdvisor endpoint without disabl…
Vulnerabilities
11 records
TI-2026-06035 CVE-2026-6881 · GHSA-xfrq-3339-mcj4
SQL injection in Ellucian Advance Web
Priority MEDIUM 42
A SQL Injection in the Giving Reports functionality in Ellucian Advance Web and Legacy Advance allows an authenticated attacker to extract sensitive information from databases via a crafted SQL query in the class credit…
TI-2026-34704 CVE-2026-47106 · GHSA-pgpc-33v2-x2qg
Ellucian Banner Self-Service Stored XSS via getFacultyMeetingTimes API
Priority LOW 23
Ellucian Banner Self-Service before the April T2 release (2025-04-23) contains a stored cross-site scripting vulnerability in the course search functionality that allows authenticated Banner ERP users to inject malicious…
TI-2026-25318 CVE-2026-32856 · GHSA-x7x7-w9rf-g664
Ellucian Banner Self-Service Reflected XSS via dateConverter
Priority LOW 23
Ellucian Banner Self-Service before the April T2 release (2025-04-23) contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by…
TI-2023-26952 CVE-2023-49339 · GHSA-m839-rvvg-g25r
Ellucian Banner 9.17 allows Insecure Direct Object Reference (IDOR) via a modified…
Priority MEDIUM 62
Ellucian Banner 9.17 allows Insecure Direct Object Reference (IDOR) via a modified bannerId to the /StudentSelfService/ssb/studentCard/retrieveData endpoint.
TI-2023-02643 CVE-2023-2822 · GHSA-q67p-g93x-788p
Ellucian Ethos Identity logout cross site scripting
Priority MEDIUM 60
A vulnerability was found in Ellucian Ethos Identity up to 5.10.5.
TI-2019-06469 CVE-2019-8978 · GHSA-fcm9-r389-xjjv
An improper authentication vulnerability can be exploited through a race condition that…
Priority MEDIUM 44
An improper authentication vulnerability can be exploited through a race condition that occurs in Ellucian Banner Web Tailor 8.8.3, 8.8.4, and 8.9 and Banner Enterprise Identity Services 8.3, 8.3.1, 8.3.2, and 8.4, in co…
TI-2015-04238 CVE-2015-5054 · GHSA-v38f-5hv3-pw6r
Open redirect vulnerability in Ellucian (formerly SunGard) Banner Student 8.5.1.2 through…
Priority LOW 30
Open redirect vulnerability in Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in an unspecified para…
TI-2015-03926 CVE-2015-4689 · GHSA-52cr-x5c3-f4qr
Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allows remote attackers to…
Priority MEDIUM 46
Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allows remote attackers to reset arbitrary passwords via unspecified vectors, aka "Weak Password Reset."
TI-2015-03925 CVE-2015-4688 · GHSA-4m8f-fmhm-mchq
Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allow remote attackers to…
Priority LOW 28
Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allow remote attackers to enumerate user accounts via a series of requests.
TI-2015-03924 CVE-2015-4687 · GHSA-h9rm-vp45-cf2x
Cross-site scripting (XSS) vulnerability in Ellucian (formerly SunGard) Banner Student…
Priority LOW 30
Cross-site scripting (XSS) vulnerability in Ellucian (formerly SunGard) Banner Student 8.5.1.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.