Startraining
Monthly
Cross-site scripting in zhistaredu StarTraining up to and including 3.8.1 becomes exploitable when the built-in XSS filter is switched off by setting xss.enabled to false in the application.yml configuration file. This issue is not independently exploitable: it is a defense-in-depth gap that amplifies the companion injection flaw CVE-2026-100880, and both must be present for an attack to succeed. Exploitation requires authenticated low-privilege access (PR:L) and victim interaction (UI:P) and is rated as highly complex, with the vendor assigning a CVSS base of 2.1; publicly available exploit code exists (published via the ArrestX StarTraining advisories repository), and the vendor was contacted but did not respond, so no vendor-released patch is identified at time of analysis.
Missing authorization in zhistaredu StarTraining up to and including version 3.8.1 lets any authenticated low-privilege user invoke privileged role-management operations through the dataScope endpoint, because the checkRoleAllowed function in SysRoleServiceImpl.java performs role CRUD without an authorization guard. Exploitation requires only a valid low-privilege account (CVSS 4.0 PR:L, network reachable) and no user interaction; the outcome is integrity-low role and data-scope tampering with no direct confidentiality or availability impact. Publicly available exploit code exists (referenced from the ArrestX/startraining-advisories ST-VULN-005 advisory) and the vendor did not respond to early disclosure, so no vendor-released patch has been identified at time of analysis; the product has a small deployment base, which limits real-world exposure.
Authorization bypass in zhistaredu StarTraining through 3.8.1 allows an authenticated low-privileged user to escalate privileges by manipulating the userId/roleIds parameters sent to the authRole endpoint, because the SysUser.isAdmin authorization logic trusts caller-supplied identifiers instead of the authenticated principal. Publicly available exploit code exists (published in the ArrestX StarTraining advisories repository as ST-VULN-004), but there is no evidence of confirmed active exploitation, and no vendor patch has been released. Independent assessment classifies this as a genuine but low-priority issue: exploitation requires a valid low-privileged account, the affected product has a very small footprint, and mitigation currently depends on access controls.
Unauthenticated access to the Swagger/OpenAPI api-docs endpoint in zhistaredu StarTraining through 3.8.1 allows remote attackers to retrieve API documentation and structural details when the endpoint is network-reachable and SecurityConfig.java lacks an authentication filter. Public exploit code exists, but this is an information-disclosure issue (assessed CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), not confirmed active exploitation; the vendor did not respond to the disclosure. The practical risk depends on exposing the api-docs route, and impact is limited to confidentiality of API structure.
Unauthenticated remote access to the Alibaba Druid monitoring console bundled with zhistaredu StarTraining 3.8.1 and earlier allows anyone who can reach the /druid/index.html endpoint to view monitoring data and perform console reset operations without credentials. No user interaction or privileges are required (CVSS vector PR:N/UI:N), though real-world exposure depends on the Druid StatViewServlet being enabled and network-reachable without an authentication filter - a non-default but commonly insecure configuration. Publicly available exploit code exists (a GitHub advisory with reproduction details), but there is no evidence of confirmed active exploitation, and the vendor was contacted and did not respond.
StarTraining 3.8.1 and earlier embeds a hard-coded JWT signing secret in application.yml, allowing an unauthenticated remote attacker who knows that static value to forge valid authentication tokens carrying attacker-chosen user_id and company_id claims, effectively impersonating arbitrary users without any credentials. Publicly available exploit code exists (a GitHub advisory demonstrates forging tokens from the shipped secret), but the flaw is not in CISA KEV and no confirmed active exploitation has been reported. The vendor was contacted about the disclosure and did not respond, so no vendor-released patch is identified; installations that have rotated the JWT signing secret away from the shipped default are not exploitable through the disclosed value.
Cross-site scripting in zhistaredu StarTraining up to and including 3.8.1 becomes exploitable when the built-in XSS filter is switched off by setting xss.enabled to false in the application.yml configuration file. This issue is not independently exploitable: it is a defense-in-depth gap that amplifies the companion injection flaw CVE-2026-100880, and both must be present for an attack to succeed. Exploitation requires authenticated low-privilege access (PR:L) and victim interaction (UI:P) and is rated as highly complex, with the vendor assigning a CVSS base of 2.1; publicly available exploit code exists (published via the ArrestX StarTraining advisories repository), and the vendor was contacted but did not respond, so no vendor-released patch is identified at time of analysis.
Missing authorization in zhistaredu StarTraining up to and including version 3.8.1 lets any authenticated low-privilege user invoke privileged role-management operations through the dataScope endpoint, because the checkRoleAllowed function in SysRoleServiceImpl.java performs role CRUD without an authorization guard. Exploitation requires only a valid low-privilege account (CVSS 4.0 PR:L, network reachable) and no user interaction; the outcome is integrity-low role and data-scope tampering with no direct confidentiality or availability impact. Publicly available exploit code exists (referenced from the ArrestX/startraining-advisories ST-VULN-005 advisory) and the vendor did not respond to early disclosure, so no vendor-released patch has been identified at time of analysis; the product has a small deployment base, which limits real-world exposure.
Authorization bypass in zhistaredu StarTraining through 3.8.1 allows an authenticated low-privileged user to escalate privileges by manipulating the userId/roleIds parameters sent to the authRole endpoint, because the SysUser.isAdmin authorization logic trusts caller-supplied identifiers instead of the authenticated principal. Publicly available exploit code exists (published in the ArrestX StarTraining advisories repository as ST-VULN-004), but there is no evidence of confirmed active exploitation, and no vendor patch has been released. Independent assessment classifies this as a genuine but low-priority issue: exploitation requires a valid low-privileged account, the affected product has a very small footprint, and mitigation currently depends on access controls.
Unauthenticated access to the Swagger/OpenAPI api-docs endpoint in zhistaredu StarTraining through 3.8.1 allows remote attackers to retrieve API documentation and structural details when the endpoint is network-reachable and SecurityConfig.java lacks an authentication filter. Public exploit code exists, but this is an information-disclosure issue (assessed CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), not confirmed active exploitation; the vendor did not respond to the disclosure. The practical risk depends on exposing the api-docs route, and impact is limited to confidentiality of API structure.
Unauthenticated remote access to the Alibaba Druid monitoring console bundled with zhistaredu StarTraining 3.8.1 and earlier allows anyone who can reach the /druid/index.html endpoint to view monitoring data and perform console reset operations without credentials. No user interaction or privileges are required (CVSS vector PR:N/UI:N), though real-world exposure depends on the Druid StatViewServlet being enabled and network-reachable without an authentication filter - a non-default but commonly insecure configuration. Publicly available exploit code exists (a GitHub advisory with reproduction details), but there is no evidence of confirmed active exploitation, and the vendor was contacted and did not respond.
StarTraining 3.8.1 and earlier embeds a hard-coded JWT signing secret in application.yml, allowing an unauthenticated remote attacker who knows that static value to forge valid authentication tokens carrying attacker-chosen user_id and company_id claims, effectively impersonating arbitrary users without any credentials. Publicly available exploit code exists (a GitHub advisory demonstrates forging tokens from the shipped secret), but the flaw is not in CISA KEV and no confirmed active exploitation has been reported. The vendor was contacted about the disclosure and did not respond, so no vendor-released patch is identified; installations that have rotated the JWT signing secret away from the shipped default are not exploitable through the disclosed value.