{"id":"CVE-2026-38671","title":"Cross Site Scripting vulnerability in Ellucian Banner Student Registration Self-Service (StudentRegistrationSsb) 9.23 and prior (no fixed version available) allows a remote attacker to execute arbitrary code via the mepCode parameter of …","summary":"Cross Site Scripting vulnerability in Ellucian Banner Student Registration Self-Service (StudentRegistrationSsb) 9.23 and prior (no fixed version available) allows a remote attacker to execute arbitrary code via the mepCode parameter of …","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvssSource":"adp","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-19T17:51:39.138782Z"},"published":"2026-10-19","updated":"2026-10-19","sourceUpdated":"2026-10-19T17:52:06.247Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-38671","references":[{"url":"http://ellucian.com"},{"url":"http://banner.com"},{"url":"https://gist.github.com/xAR191/7831b15a1a9b15f3fdbf6786a5b74c5e"}],"tags":["cve.org"],"ingestedAt":"2026-10-19T13:28:55.895Z","epss":0.00361,"epssPercentile":0.29675,"slug":"CVE-2026-38671","body":"## Overview\n\nCross Site Scripting vulnerability in Ellucian Banner Student Registration Self-Service (StudentRegistrationSsb) 9.23 and prior (no fixed version available) allows a remote attacker to execute arbitrary code via the mepCode parameter of the /ssb/registration endpoint\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":225096,"id":"CVE-2026-38671","ts":1792435057349,"field":"cvss","old":null,"new":"6.1"},{"seq":225095,"id":"CVE-2026-38671","ts":1792435057349,"field":"severity","old":"none","new":"medium"}]}