CVE-2026-12425CWE-79cross-site-scripting

CVE-2026-12425

Medium · published June 17, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
3.8
In the wild
Unconfirmed
What it is

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PowerSchool Employee Access Center allows Cross-Site Scripting (XSS). This issue affects Employee Access Center: 23.10. It is possible to add in javascript code after the login URL and have it be eval()'d in the page and execute in the context of the user.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00149 · 3.8th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-06-17T00:16Z
Affected products (1)
ProductVersionsFixed in
powerschool/employee_access_centerall versions—
References (1)
https://github.com/PaloAltoNetworks/u42-vulnerability-disclosures/blob/main/2026/PANW-2026-0002/PANW-2026-0003.md · [email protected]
EPSS history
Timeline
  • 16 JUN 18:34Z
    Reflected / DOM cross-site scripting (XSS) in PowerSchool ERP / Employee Access Center 23.10
    cvelistv5