CVE-2026-100881

zhistaredu StarTraining application.yml cross site scripting

View on CVE.org
Published Sep 27, 2026 CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Description
A security vulnerability has been detected in zhistaredu StarTraining up to 3.8.1. This issue affects some unknown processing of the file application.yml. Such manipulation of the argument xss.enabled leads to cross site scripting. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The exploit has been disclosed publicly and may be used. Not independently exploitable: a defense-in-depth absence that amplifies CVE-2026-100880. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

A flaw in the StarTraining configuration file causes the xss.enabled option to be ignored, allowing attackers to inject malicious scripts that execute in the context of legitimate users. The vulnerability is delivered via the application.yml file, can be triggered remotely, and is deemed difficult to exploit because it requires specific manipulation of the configuration. The weakness is classified under CWE‑79 (XSS) and CWE‑94 (Code Injection), indicating that unsanitized input reaches a scripting context and that code may be evaluated.

Affected Systems

The issue affects the StarTraining application from zhistaredu, with affected versions up to 3.8.1. No other vendors or products are listed. The known CPE identifies the product as cpe:2.3:a:zhistaredu:startraining:*:*:*:*:*:*:*.*

Risk and Exploitability

The CVSS score of 2.1 reflects a low technical severity, and no EPSS data is available. The vulnerability is not listed in the CISA KEV catalog. The exploit is publicly disclosed but complex and considered difficult, suggesting limited real‑world exploitation. Nonetheless, attackers that succeed could hijack user sessions or execute arbitrary JavaScript, posing a confidentiality and integrity threat to affected users.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update StarTraining to a version newer than 3.8.1 or apply the vendor’s patch if one becomes available.
  • If an update is not immediately possible, modify application.yml to set xss.enabled=true to re‑enable the XSS filtering mechanism.
  • Enable an input‑validation or sanitization layer on any data that originates from or is stored in application.yml, or restrict file access to trusted administrators only.
  • Monitor access logs for repeated attempts to inject malicious content or abnormal configuration changes.

Generated by OpenCVE AI on September 27, 2026 at 22:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A security vulnerability has been detected in zhistaredu StarTraining up to 3.8.1. This issue affects some unknown processing of the file application.yml. Such manipulation of the argument xss.enabled leads to cross site scripting. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The exploit has been disclosed publicly and may be used. Not independently exploitable: a defense-in-depth absence that amplifies CVE-2026-100880. The vendor was contacted early about this disclosure but did not respond in any way.
Title zhistaredu StarTraining application.yml cross site scripting
First Time appeared Zhistaredu
Zhistaredu startraining
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:zhistaredu:startraining:*:*:*:*:*:*:*:*
Vendors & Products Zhistaredu
Zhistaredu startraining
References
Metrics cvssV2_0

{'score': 2.1, 'vector': 'AV:N/AC:H/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 2.6, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 2.6, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 2.1, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 28, 2026, 12:59 PM
Reserved
Sep 27, 2026, 3:37 AM

View source JSON

Updated
Sep 28, 2026, 12:59 PM

JSON

Status
Deferred
Published
Sep 27, 2026, 10:17 PM
Modified
Sep 28, 2026, 3:16 PM

View source JSON

No data.

Updated
Sep 27, 2026, 11:30 PM

JSON