StarTraining EUVD-2026-88028

Requires the StarTraining xss.enabled setting in application.yml to be set to false (disabling the built-in XSS filter), AND requires the companion injection point CVE-2026-100880 to be present, since this CVE is not independently exploitable. Exploitation further requires low-privilege authenticated access (PR:L) and victim user interaction (UI:P/UI:R) to trigger script execution, and the vendor/VulDB both rate attack complexity as high ('difficult'). Limiting factors: it only amplifies another vulnerability, needs a non-default filter-disabled configuration, needs valid credentials, and needs a victim to view the injected content.

This is a low-priority, low-severity issue by every available signal. The vendor CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N) scores only 2.1, and the description itself repeatedly downgrades it: 'highly complex,' 'exploitability assessed as difficult,' and - most importantly - 'Not independently exploitable: a defense-in-depth absence that amplifies CVE-2026-100880.' In other words, this CVE is not a standalone flaw but the fact that the xss.enabled filter in application.yml can be turned off, which removes a mitigation for the companion stored/reflected XSS in CVE-2026-100880. POC/exploit code is publicly available (ArrestX advisory ST-VULN-007), so exploitation status is 'publicly available exploit code exists' - but there is NO EPSS score, NO CISA KEV listing, and no evidence of active exploitation. The signals are internally consistent: a genuinely hard-to-exploit, integrity-only (VI:L), non-scope-changing defense-in-depth gap. The only mild tension is that a 'publicly disclosed exploit' pairs with a very low CVSS - this reflects that the POC is a documented configuration/technique note rather than a reliable weaponized exploit. This is a low-real-risk issue, not a hidden high-severity one.

An operator (or an attacker with low-privilege access) leaves or sets xss.enabled=false in StarTraining's application.yml, disabling the built-in XSS input filter. An authenticated attacker then submits a crafted payload through the related injection point (CVE-2026-100880), and because the filter is off the script is stored/reflected and executes in a victim's browser when they view the content. A public advisory (ArrestX ST-VULN-007) documents the disabled-filter condition.