This vulnerability in zhistaredu StarTraining up to version 3.8.1 involves improper handling of the xss.enabled argument in the application.yml configuration file, leading to a cross-site scripting condition. The attack can be launched remotely but is considered difficult to exploit. It is not independently exploitable and serves to amplify the impact of CVE-2026-100880 due to a lack of defense-in-depth controls. The vendor has not provided any response or remediation guidance, and no official patch is documented.

Successful exploitation could allow an attacker to execute cross-site scripting attacks remotely, potentially leading to client-side script execution in the context of the affected application. However, the exploitability is difficult, and the vulnerability is not independently exploitable, requiring the presence of another vulnerability (CVE-2026-100880) to have significant impact. The CVSS score of 2.1 reflects the low severity and limited impact.

No official patch or remediation is currently available, and the vendor has not responded to disclosure. Users should monitor vendor communications for updates. Due to the complexity and difficulty of exploitation, immediate urgent action is not indicated. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.