Ellucian Banner Self‑Service versions prior to the April T2 release (2025‑04‑23) have a stored cross‑site scripting flaw in the course search functionality that lets authenticated Banner ERP users inject malicious JavaScript into faculty and course fields. The flaw stems from missing HTML encoding during DOM insertion. An attacker with write access can store scripts in fields such as faculty displayName, emailAddress, subjectDescription, or courseTitle, and these values are later returned unsanitized by the unauthenticated getFacultyMeetingTimes API endpoint. When any user opens the affected course’s meeting times, the stored script runs in the victim’s browser, enabling arbitrary client‑side code execution.

The vulnerability affects Ellucian Banner Self‑Service software. All releases before the April T2 update (2025‑04‑23) are vulnerable; later releases presumably contain the fix.

The CVSS score of 5.1 indicates moderate severity, and the EPSS score is <1%, indicating a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is through the publicly accessible getFacultyMeetingTimes API, but the injection payload must be submitted by an authenticated Banner ERP user. Once stored, the payload executes in the victim’s browser context, providing client‑side code execution.