A cross-site scripting vulnerability has been identified in zhistaredu StarTraining up to version 3.8.1. The flaw resides in the Upload Endpoint component within the MimeTypeUtils.java file, where manipulation of the File argument can lead to XSS. The vulnerability is remotely exploitable and public exploit code exists. The vendor was notified but has not issued any response or fix.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other malicious actions involving user interaction. The CVSS score of 5.1 indicates a medium severity impact with network attack vector, low attack complexity, and requiring user interaction.

No official fix or patch is currently available, and the vendor has not responded to the disclosure. Users should apply general XSS mitigations such as input validation and output encoding where possible. Monitor vendor channels for any future updates or patches addressing this vulnerability.