Advance Web CVE-2026-6881

Q: What is the CVSS score of CVE-2026-6881?

CVE-2026-6881 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-50019 CRITICAL

SQL Injection (CWE-89)

2026-07-28 SRA

GHSA-xfrq-3339-mcj4

SQLi Advance Web Legacy Advance Ellucian

9.4

CVSS 4.0 · Vendor: SRA

Severity by source

Vendor (SRA) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (SRA) · only source for this CVE.

CVSS VectorVendor: SRA

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 21:01 vuln.today

CVE Published

Jul 28, 2026 - 20:03 cve.org

CRITICAL 9.4

DescriptionCVE.org

A SQL Injection in the Giving Reports functionality in Ellucian Advance Web and Legacy Advance allows an authenticated attacker to extract sensitive information from databases via a crafted SQL query in the class credit field.

This issue affects Advance Web: all versions; Legacy Advance: all versions.

Ellucian CRM Advance is not impacted.

AnalysisAI

SQL injection in the Giving Reports functionality of Ellucian Advance Web and Legacy Advance allows an authenticated attacker to extract sensitive information from databases. All versions of both products are affected; the class credit field is the injection point. A detailed technical write-up with exploit details is publicly available, though no active exploitation has been reported through CISA KEV.