CVE-2026-38671

CVSS 6.1 (medium) · published 2026-10-19

Cross Site Scripting vulnerability in Ellucian Banner Student Registration Self-Service (StudentRegistrationSsb) 9.23 and prior (no fixed version available) allows a remote attacker to execute arbitrary code via the mepCode parameter of the /ssb/registration endpoint

Weakness: CWE-79

Source: NVD CVE-2026-38671

References

• http://banner.com
• http://ellucian.com
• https://gist.github.com/xAR191/7831b15a1a9b15f3fdbf6786a5b74c5e

Check your software

Connect an AI agent to the Fixlane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.