{"id":"CVE-2026-38671","title":"Cross Site Scripting vulnerability in Ellucian Banner Student Registration Self-Service (StudentRegistrationSsb) 9.23 and prior (no fixed version available) allows a remote attacker to execute arbitrary code via the mepCode parameter of …","summary":"Cross Site Scripting vulnerability in Ellucian Banner Student Registration Self-Service (StudentRegistrationSsb) 9.23 and prior (no fixed version available) allows a remote attacker to execute arbitrary code via the mepCode parameter of …","severity":"none","published":"2026-10-19","updated":"2026-10-19","sourceUpdated":"2026-10-19T12:39:50.094Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-38671","references":[{"url":"http://ellucian.com"},{"url":"http://banner.com"},{"url":"https://gist.github.com/xAR191/7831b15a1a9b15f3fdbf6786a5b74c5e"}],"tags":["cve.org"],"ingestedAt":"2026-10-19T13:28:55.895Z","slug":"CVE-2026-38671","body":"## Overview\n\nCross Site Scripting vulnerability in Ellucian Banner Student Registration Self-Service (StudentRegistrationSsb) 9.23 and prior (no fixed version available) allows a remote attacker to execute arbitrary code via the mepCode parameter of the /ssb/registration endpoint\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}