Unverified50% confidenceEventExact time
In the demonstration, after the operator submitted the script alert payload provided by the Agent, a pop-up appeared on the page, and when navigating away and returning to the page, the pop-up appeared again, confirming the existence of a stored XSS vulnerability.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
9/12/2026
First Seen
Valid until: 12/11/2026
Sources
Related Entities
Related Claims
UnverifiedAttackers tamper with a model's chat template by calling the create API, permanently injecting malicious instructions into the System prompt; this change is stored in the model's Modelfile and is invisible to the client and undetectable by standard tools.61% similarUnverified通过Shell_NotifyIcon API，开发者可以在托盘区域注册图标，程序向Explorer进程注册一个NOTIFYICONDATA结构体，Explorer负责绘制图标并转发用户交互事件60% similarUnverifiedUnder the EDA architecture, business systems actively push event notifications via Webhook, and after YCloud receives them, it automatically triggers the corresponding WhatsApp notifications based on preset templates.60% similarUnverified攻击者可利用npm的postinstall脚本机制在包安装时自动执行任意代码59% similarUnverifiedYCloud's API platform adopts an Event-Driven Architecture (EDA), proactively pushing event notifications via Webhooks when the state of a business system changes, achieving near-real-time responses at the millisecond-to-second level.59% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/914782API
curl https://kongchang.com/api/v1/knowledge/claims/914782MCP
get_claim(id=914782)