Executive brief
PowerSchool Employee Access Center, a portal used by staff to manage employment information, contains a security flaw that allows attackers to run malicious scripts in a user's browser. By tricking a user into clicking a specially crafted login link, an attacker could potentially steal session information or perform actions on behalf of the user. This could lead to unauthorized access to sensitive employee data or internal systems.
Technical details
A reflected Cross-Site Scripting (XSS) vulnerability exists in PowerSchool Employee Access Center version 23.10. The application fails to properly neutralize input appended to the login URL, which is subsequently processed by the eval() function within the page. An unauthenticated remote attacker can exploit this by crafting a malicious URL containing JavaScript and inducing a user to visit it. Successful exploitation allows the attacker to execute arbitrary code in the context of the victim's browser session, potentially leading to session hijacking or unauthorized data exfiltration.
Affected products
- PowerSchool Employee Access Center 23.10
Timeline
- 2026-06-16: disclosed
- 2026-06-16: advisory