Ellucian Banner Self‑Service versions prior to the April T2 release (2025‑04‑23) store data entered into the course search functionality without proper HTML encoding. This defect allows an authenticated Banner ERP user to inject malicious JavaScript into fields such as faculty display name, email address, subject description, or course title via the getFacultyMeetingTimes API. When a browser processes the retrieved data, the injected script runs with the privileges of the viewing user, potentially allowing data exfiltration, session hijacking, or defacement.

The vulnerability affects Ellucian Banner Self‑Service software. All releases before the April T2 update (2025‑04‑23) are vulnerable; later releases presumably contain the fix.

The CVSS score of 5.1 indicates moderate severity, and the EPSS score is not available, so the likelihood of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog. The attack vector is through the publicly accessible getFacultyMeetingTimes API, but the injection payload must be submitted by an authenticated Banner ERP user. Once stored, the payload executes in the victim’s browser context, providing client‑side code execution.