ChangeIntel IT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-12425

Reflected / DOM cross-site scripting (XSS) in PowerSchool ERP / Employee Access Center 23.10

CVSS 4.0 5.7 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.

cve-program · CVE-2026-12425

Published

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PowerSchool Employee Access Center allows Cross-Site Scripting (XSS). This issue affects Employee Access Center: 23.10. It is possible to add in javascript code after the login URL and have it be eval()'d in the page and execute in the context of the user.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-12425

Published

Employee Access Center

https://www.powerschool.com/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "PowerSchool",
                    "product": "Employee Access Center",
                    "collectionURL": "https://www.powerschool.com/",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "23.10"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON