CVE-2026-100881

LOW 2.6

zhistaredu StarTraining application.yml cross site scripting

CVSS Score

2.6

EPSS Score

0.0%

EPSS Percentile

0th

A security vulnerability has been detected in zhistaredu StarTraining up to 3.8.1. This issue affects some unknown processing of the file application.yml. Such manipulation of the argument xss.enabled leads to cross site scripting. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The exploit has been disclosed publicly and may be used. Not independently exploitable: a defense-in-depth absence that amplifies CVE-2026-100880. The vendor was contacted early about this disclosure but did not respond in any way.

CWE	CWE-79 CWE-94
Vendor	zhistaredu
Product	startraining
Published	Sep 27, 2026

Stay Ahead of the Next One

Get instant alerts for zhistaredu startraining

Be the first to know when new low vulnerabilities affecting zhistaredu startraining are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

zhistaredu / StarTraining

3.8.0 3.8.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/410811 vuldb.com: https://vuldb.com/vuln/410811/cti vuldb.com: https://vuldb.com/cve/CVE-2026-100881 vuldb.com: https://vuldb.com/submit/915513 github.com: https://github.com/ArrestX/startraining-advisories/blob/main/advisories/ST-VULN-007-xss-filter-disabled.md

Credits

🔍 thmanhz (VulDB User) VulDB CNA Team