SQL Injection in Ellucian Advance Web
CVE-2026-6881
A SQL Injection in the Giving Reports functionality in Ellucian Advance Web and Legacy Advance allows an authenticated attacker to extract sensitive information from databases via a crafted SQL query in the class credit field. This issue affects Advance Web: all versions; Legacy Advance: all versions. Ellucian CRM Advance is not impacted.
Vulnerability class: SQL Injection
EPSS: 0.002 (10.3th percentile) — read the EPSS interpretation.
Affected products
- Ellucian Advance Web — versions 0
- Ellucian Legacy Advance — versions 0
Weakness classification (CWE)
References
- 57dba5dd-1a03-47f6-8b36-e84e47d335d8 (third-party-advisory)