{"id":"CVE-2026-6881","title":"A SQL Injection in the Giving Reports functionality in Ellucian Advance Web and Legacy Advance allows an authenticated attacker to extract sensitive information from databases via a crafted SQL query in the class credit field.\n\n\n\nThis is…","summary":"A SQL Injection in the Giving Reports functionality in Ellucian Advance Web and Legacy Advance allows an authenticated attacker to extract sensitive information from databases via a crafted SQL query in the class credit field.\n\n\n\nThis is…","severity":"none","cwe":["CWE-89"],"published":"2026-07-28","updated":"2026-09-09","sourceUpdated":"2026-09-09T15:52:04.827","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-6881","references":[{"url":"https://labs.sra.io/posts/ellucian","label":"57dba5dd-1a03-47f6-8b36-e84e47d335d8"}],"tags":["nvd"],"epss":0.00203,"epssPercentile":0.10602,"ingestedAt":"2026-09-09T16:14:05.510Z","slug":"CVE-2026-6881","body":"## Overview\n\nA SQL Injection in the Giving Reports functionality in Ellucian Advance Web and Legacy Advance allows an authenticated attacker to extract sensitive information from databases via a crafted SQL query in the class credit field.\n\n\n\nThis issue affects Advance Web: all versions; Legacy Advance: all versions.\n\n\n\nEllucian CRM Advance is not impacted.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}