Description
A security vulnerability has been detected in zhistaredu StarTraining up to 3.8.1. This issue affects some unknown processing of the file application.yml. Such manipulation of the argument xss.enabled leads to cross site scripting. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The exploit has been disclosed publicly and may be used. Not independently exploitable: a defense-in-depth absence that amplifies CVE-2026-100880. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-27
Score: 2.1 Low
EPSS: n/a
KEV: No
Impact: Remote Cross‑Site Scripting
Action: Assess Impact
AI Analysis

Impact

A flaw in the StarTraining configuration file causes the xss.enabled option to be ignored, allowing attackers to inject malicious scripts that execute in the context of legitimate users. The vulnerability is delivered via the application.yml file, can be triggered remotely, and is deemed difficult to exploit because it requires specific manipulation of the configuration. The weakness is classified under CWE‑79 (XSS) and CWE‑94 (Code Injection), indicating that unsanitized input reaches a scripting context and that code may be evaluated.

Affected Systems

The issue affects the StarTraining application from zhistaredu, with affected versions up to 3.8.1. No other vendors or products are listed. The known CPE identifies the product as cpe:2.3:a:zhistaredu:startraining:*:*:*:*:*:*:*.*

Risk and Exploitability

The CVSS score of 2.1 reflects a low technical severity, and no EPSS data is available. The vulnerability is not listed in the CISA KEV catalog. The exploit is publicly disclosed but complex and considered difficult, suggesting limited real‑world exploitation. Nonetheless, attackers that succeed could hijack user sessions or execute arbitrary JavaScript, posing a confidentiality and integrity threat to affected users.

Generated by OpenCVE AI on September 27, 2026 at 22:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update StarTraining to a version newer than 3.8.1 or apply the vendor’s patch if one becomes available.
  • If an update is not immediately possible, modify application.yml to set xss.enabled=true to re‑enable the XSS filtering mechanism.
  • Enable an input‑validation or sanitization layer on any data that originates from or is stored in application.yml, or restrict file access to trusted administrators only.
  • Monitor access logs for repeated attempts to inject malicious content or abnormal configuration changes.

Generated by OpenCVE AI on September 27, 2026 at 22:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 27 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in zhistaredu StarTraining up to 3.8.1. This issue affects some unknown processing of the file application.yml. Such manipulation of the argument xss.enabled leads to cross site scripting. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The exploit has been disclosed publicly and may be used. Not independently exploitable: a defense-in-depth absence that amplifies CVE-2026-100880. The vendor was contacted early about this disclosure but did not respond in any way.
Title zhistaredu StarTraining application.yml cross site scripting
First Time appeared Zhistaredu
Zhistaredu startraining
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:zhistaredu:startraining:*:*:*:*:*:*:*:*
Vendors & Products Zhistaredu
Zhistaredu startraining
References
Metrics cvssV2_0

{'score': 2.1, 'vector': 'AV:N/AC:H/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 2.6, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 2.6, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 2.1, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Zhistaredu Startraining
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-27T21:15:12.454Z

Reserved: 2026-09-27T03:37:59.185Z

Link: CVE-2026-100881

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-27T22:17:05.047

Modified: 2026-09-27T22:17:05.047

Link: CVE-2026-100881

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-27T22:30:17Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')