{"id":"CVE-2026-12425","revision":"c0a7abfe15d34ee6959ab39eca8bbdd5","records":[{"revision":"c0a7abfe15d34ee6959ab39eca8bbdd5","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-12425","aliases":[],"title":"Reflected / DOM cross-site scripting (XSS) in PowerSchool ERP / Employee Access Center 23.10","description":"Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PowerSchool Employee Access Center allows Cross-Site Scripting (XSS).\u00A0This issue affects Employee Access Center: 23.10.\u00A0It is possible to add in javascript code after the login URL and have it be eval()'d in the page and execute in the context of the user.","state":0,"publishedAt":"2026-06-16T18:34:28.435+00:00","modifiedAt":"2026-09-30T19:48:13.071+00:00","affected":[{"ecosystem":"https://www.powerschool.com/","name":"Employee Access Center","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"PowerSchool\",\n                    \"product\": \"Employee Access Center\",\n                    \"collectionURL\": \"https://www.powerschool.com/\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"23.10\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H/E:P","score":5.7,"severity":"MEDIUM"}],"references":["https://github.com/PaloAltoNetworks/u42-vulnerability-disclosures/blob/main/2026/PANW-2026-0002/PANW-2026-0003.md"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-12425","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-12425","identifiers":["CVE-2026-12425"]},"retained":false,"historicalAffected":[]}],"coverage":[]}