The vulnerability is a reflected cross‑site scripting flaw located in the dateConverter endpoint of Ellucian Banner Self‑Service. An attacker can craft a URL that embeds JavaScript through the toDateFormat query string. Because the input is not sanitized, the script is reflected back to the victim’s browser, allowing the attacker to steal session cookies or perform other malicious actions. This weakness is classified as CWE‑79.

Ellucian Banner Self‑Service is affected. Any version prior to the April T2 release (23 April 2025) is vulnerable.

The CVSS score of 5.1 indicates medium severity. The flaw is exploitable by unauthenticated users via a crafted URL targeting the dateConverter endpoint, without needing privileged access. Attackers can inject malicious scripts into the victim’s browser, potentially enabling session hijacking or other browser‑based attacks. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, but the lack of known exploitation does not reduce the need for timely mitigation.