Live › vulnerability › CVE-2026-38671
Go to dashboardEllucian Banner Student Registration Self-Service (StudentRegistrationSsb) 9.23 and earlier fails to sanitize the mepCode parameter on the /ssb/registration endpoint, enabling cross-site scripting. A remote attacker can get a victim's browser to run script in the context of the Banner session, which can expose student data or actions taken as that user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Institutions running Ellucian Banner Student Registration Self-Service at version 9.23 or earlier are exposed, since the flaw is on the public registration endpoint. Sites that do not run this module, or run a newer release the sources do not list as affected, can skip it.
No product ranges from the sources yet.
9.23 and earlier, using the vendor's admin or release documentation/ssb/registration endpoint reflects the mepCode parameter unescaped, for example with a harmless marker in a request to a non-production instancemepCode parameter at a web application firewall or reverse proxyEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cross Site Scripting vulnerability in Ellucian Banner Student Registration Self-Service (StudentRegistrationSsb) 9.23 and prior (no fixed version available) allows a remote attacker to execute arbitrary code via the mepCode parameter of the /ssb/registration endpoint
This page as .md · .json · in your agent: get_signal("CVE-2026-38671")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.