Follet School Solutions Destiny contains a reflected cross‑site scripting flaw that is triggered by the site parameter of the handleloginform.do endpoint. A remote attacker can supply a malicious payload in that parameter, causing the victim’s browser to execute arbitrary JavaScript. This can lead to session hijacking, data theft, or defacement of the interface, compromising data confidentiality and integrity for users who interact with the affected page.

The vulnerability affects Follet School Solutions Destiny versions prior to 22.0.1 AU1. Users running any earlier build should verify that they are on a later release or have applied a vendor‑issued fix.

The CVSS score of 5.1 indicates a moderate severity and the EPSS score is not available, but the vulnerability is publicly reachable via a web endpoint that does not require authentication. It is listed outside the CISA KEV catalog, suggesting no confirmed widespread exploitation yet. Nonetheless, the ability to execute arbitrary client‑side code poses significant risk to all users of the affected system.