Ellucian Banner Student Registration Self‑Service contains a cross‑site scripting flaw that allows an attacker to inject and execute arbitrary JavaScript in the /ssb/registration endpoint by sending crafted data in the mepCode parameter. An attacker who is able to supply malicious payloads can hijack user sessions, steal credentials, modify page content, or execute arbitrary commands in the victim’s browser environment. The vulnerability is a classic XSS flaw: the input is reflected or executed without proper encoding or sanitization, enabling client‑side code execution.

The flaw is present in Ellucian Banner Student Registration Self‑Service version 9.23 and all earlier releases. At the time of assessment no fixed or patched version has been released, so the vulnerability remains exploitable in all supported installations of those releases.

Because the vulnerability is triggered via a publicly accessible HTTP parameter, a remote attacker can invoke the flaw without requiring authentication or special privileges. Although CVSS and EPSS metrics are not available, the lack of a repair and the presence of a pure XSS vector give this issue a high potential impact. The vulnerability does not appear in the CISA KEV catalog and its exploitation probability would be considered high in environments where the /ssb/registration page is reachable, as attackers can embed malicious script payloads in the mepCode value and induce victims to follow a crafted link or load a page that forces the endpoint to process the input.