Ellucian vulnerabilities
We track 2 vulnerabilities in Ellucian products across 3 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 15, 2026.
2vulnerabilities
1critical
1high
0exploited
8.4average CVSS score
Latest Ellucian vulnerabilities
- 7.5 High severity
WebAdvisor: Improper Restriction of XML External Entity Reference
Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection vulnerability that allows remote attackers to submit crafted XML POST requests to the /WebAdvisor/WebAdvisor endpoint without disabling external entity and DTD resolution.
- 9.4 Critical severity
Advance Web: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection in the Giving Reports functionality in Ellucian Advance Web and Legacy Advance allows an authenticated attacker to extract sensitive information from databases via a crafted SQL query in the class credit field. This issue affects Advance Web: a