CVE-2026-100880

Received Received - Intake

Cross-Site Scripting in StarTraining Upload Endpoint

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: VulDB

Description

A weakness has been identified in zhistaredu StarTraining up to 3.8.1. This vulnerability affects unknown code of the file du-common/src/main/java/com/edu/common/utils/file/MimeTypeUtils.java of the component Upload Endpoint. This manipulation of the argument File causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-27

Last Modified

2026-09-27

Generated

2026-09-28

AI Q&A

2026-09-28

EPSS Evaluated

N/A

NVD

CVE-2026-100880

Affected Vendors & Products

Vendor	Product	Version / Range
zhistaredu	startraining	to 3.8.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability is a cross-site scripting (XSS) weakness in the zhistaredu StarTraining software up to version 3.8.1. It exists in the file MimeTypeUtils.java and is triggered by manipulating the File argument in the Upload Endpoint component. The flaw allows attackers to inject malicious scripts into web pages viewed by other users.

Detection Guidance

This vulnerability involves a cross-site scripting (XSS) issue in the Upload Endpoint of zhistaredu StarTraining up to 3.8.1. Detection requires checking for unusual file uploads or requests to MimeTypeUtils.java. No specific commands are provided in the context.

Impact Analysis

This vulnerability could allow attackers to execute malicious scripts in your browser when you visit a page affected by the flaw. This might lead to theft of session cookies, account takeover, or unauthorized actions on your behalf. Users of the StarTraining software should avoid uploading untrusted files until patched.

Compliance Impact

This vulnerability involves a cross-site scripting (XSS) flaw in the Upload Endpoint of zhistaredu StarTraining. While it does not directly impact data confidentiality or integrity in a way that would violate GDPR or HIPAA, XSS vulnerabilities could potentially be exploited to execute malicious scripts in user browsers, leading to unauthorized data access or manipulation. However, the specific impact on compliance depends on how the application handles user-uploaded files and whether sensitive data is processed.

Mitigation Strategies

Immediate steps include updating zhistaredu StarTraining to a version beyond 3.8.1 if available. If no update exists, restrict file upload permissions, validate all uploaded files, and implement input sanitization for the Upload Endpoint.

Hi! I’m here to help you understand CVE-2026-100880. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70