PT-2026-49825 · Powerschool · Employee Access Center

Published 2026-06-16 · Updated 2026-06-16 · CVE-2026-12425

Mitre

CVSS v4.0

7.4

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PowerSchool Employee Access Center allows Cross-Site Scripting (XSS). This issue affects Employee Access Center: 23.10. It is possible to add in javascript code after the login URL and have it be eval()'d in the page and execute in the context of the user.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-12425

Affected Products

Employee Access Center

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-12425 · Security Note
• https://github.com/PaloAltoNetworks/u42-vulnerability-disclosures/blob/main/2026/PANW-2026-0002/PANW-2026-0002.md · Note