Threats affecting pkg:github/zhistaredu/startraining

A security vulnerability has been detected in zhistaredu StarTraining up to 3.8.1. This issue affects some unknown processing of the file application.yml. Such manipulation of the argument xss.enabled leads to cross site scripting. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The exploit has been disclosed publicly and may be used. Not independently exploitable: a defense-in-depth absence that amplifies CVE-2026-100880. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Affected by this issue is the function SysUser.isAdmin of the file edu-common/src/main/java/com/edu/common/core/domain/entity/SysUser.java of the component authRole Endpoint. The manipulation of the argument userId/roleIds leads to authorization bypass. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-97878 is a medium severity vulnerability in zhistaredu StarTraining versions 3.8.0 and 3.8.1. It involves missing authentication in the anonymous function of the /druid/index.html file within the Druid Console component. This flaw allows remote attackers to bypass authentication. Public exploit code is available, but no vendor response or patch has been provided.

CVE-2026-97877 is a medium severity vulnerability in zhistaredu StarTraining versions 3.8.0 and 3.8.1. It involves the use of a hard-coded password in the JWT Token Handler component, specifically in the UserLoginService.createToken function configured via application.yml. This flaw allows remote attackers to exploit the hard-coded password by manipulating user_id or company_id arguments. The vulnerability has been publicly disclosed, but the vendor has not responded or provided a fix.