A reflected cross‑site scripting flaw exists in Follet School Solutions Destiny that allows a remote attacker to inject arbitrary JavaScript into the browser of any user who visits a crafted URL. The vulnerability is triggered through the showSupportExpiredMessage parameter of handleloginform.do and can be used to steal credentials, deface the interface, or install malware on the client machine. The weakness is an input validation flaw (CWE‑79).

Follet School Solutions Destiny versions earlier than 22.0.1 AU1 are affected. The flaw resides in the Destiny application’s login handling component, and any environment running a pre‑22.0.1 AU1 release is vulnerable.

The CVSS score of 5.1 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it may not be widely exploited yet. The attack vector is remote; an attacker can simply craft a URL containing the vulnerable parameter and entice a user to visit it. No authentication is required to trigger the flaw, so anyone with access to the application can potentially exploit it. Given these conditions, the risk is moderate but non‑negligible for environments where the application is exposed to public or semi‑public users.