Expired75% confidenceEventTime unknown
Claude Code and Codex failed to discover the hidden upload.jsp interface in the first round of testing and only stayed at conventional vulnerability detection such as XSS.
1
Sources
75%
Confidence
Medium-term (~90 days)
Relevance
6/2/2026
First Seen
Valid until: 8/31/2026(expired)
Sources
Related Entities
Related Claims
Unverified早期版本的 Marked.js（CVE-2017-1000427）和 showdown 等库曾因对用户输入过滤不足导致 XSS 漏洞被公开披露66% similarUnverifiedBy default, the Codex plugin's adversarial review only scanned the file responsible for user login in the project, completely ignoring SQL injection, SSRF, and other risks in other folders within the same repository.61% similarUnverified现有基准测试（如SciBench、CyberGym）存在程序只有一个漏洞的隐含假设，但现实中很难找到只含单一漏洞的程序61% similarUnverifiedWithout any prompt guidance, DeepSeek TUI autonomously performed path traversal, successfully discovered the hidden interface upload.jsp, and verified an arbitrary file upload vulnerability.60% similarUnverifiedThe Mythos model read through the entire OpenBSD source code and discovered a vulnerability that had existed for 27 years, which had previously gone undetected through manual review, fuzzing, and static analyzers58% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/37524API
curl https://kongchang.com/api/v1/knowledge/claims/37524MCP
get_claim(id=37524)