CVE-2026-6881CWE-89sql-injection

CVE-2026-6881

published July 29, 2026

CVSS
9.4
EPSS
0%
Percentile
26.7
In the wild
Unconfirmed
What it is

A SQL Injection in the Giving Reports functionality in Ellucian Advance Web and Legacy Advance allows an authenticated attacker to extract sensitive information from databases via a crafted SQL query in the class credit field.

This issue affects Advance Web: all versions; Legacy Advance: all versions.

Ellucian CRM Advance is not impacted.

The record
Technical detail
CVSS
9.4 · NONE
CVSS v4.0
Not supplied
EPSS
0.00344 · 26.7th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-07-29T01:17Z
References (1)
https://labs.sra.io/posts/ellucian · 57dba5dd-1a03-47f6-8b36-e84e47d335d8
EPSS history
Timeline
  • 28 JUL 20:03Z
    Authenticated SQL Injection Enables Unauthorized Access to Sensitive Information in Ellucian Advance Web and Legacy Advance
    cvelistv5