CyberRota Analysis
AI-GeneratedA vulnerability in zhistaredu StarTraining versions up to 3.8.1 allows for cross-site scripting (XSS) through manipulation of the application.yml file, specifically the xss.enabled argument. Although the severity is low and the exploit is considered difficult to execute, organizations using this software should prioritize remediation due to the potential for remote attacks and the public disclosure of the exploit. Users should implement security measures to mitigate risks associated with this vulnerability, especially in environments where sensitive data may be processed.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A security vulnerability has been detected in zhistaredu StarTraining up to 3.8.1. This issue affects some unknown processing of the file application.yml. Such manipulation of the argument xss.enabled leads to cross site scripting. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The exploit has been disclosed publicly and may be used. Not independently exploitable: a defense-in-depth absence that amplifies CVE-2026-100880. The vendor was contacted early about this disclosure but did not respond in any way.