Skip to content

Translation in progress Some entries still include text in the original language.

EventPast event

AI Engine ≤3.8.0 存在未认证存储型 XSS 漏洞

1 reports1 reporting sources

Start here

AI overview

AI Engine 3.8.0 及更早版本存在未认证存储型 XSS 漏洞（CVE-2026-96561）。攻击者可经 model_ 参数将恶意内容写入 PHP 错误日志，进而对 Advisor 实施间接提示注入。该漏洞无需认证即可触发，影响范围限于 3.8.0 及以下版本。

Generated by AI from reports · Updated 7 hr ago

Progress timeline

Date not provided
  1. Date not given
    CVE Program
    AI Engine ≤3.8.0 has an unauthenticated stored XSS (CVE-2026-96561), which can achieve Advisor indirect prompt injection via PHP error log injection

    AI Engine 3.8.0 and earlier versions have an unauthenticated stored XSS vulnerability (CVE-2026-96561). An attacker can write malicious content into the PHP error log via the model_ parameter, thereby carrying out indirect prompt injection against Advisor. The vulnerability can be triggered without authentication, and the impact is limited to versions 3.8.0 and below.

Related discussion

No discussion links have been collected for this event yet.

Attention trend

New sources per day

1 in 10 days·most 1 (Oct 5)·today 0

  • Oct 5: 1 new sources (1 outlets, 0 accounts)
  • Oct 6: 0 new sources (0 outlets, 0 accounts)
  • Oct 7: 0 new sources (0 outlets, 0 accounts)
  • Oct 8: 0 new sources (0 outlets, 0 accounts)
  • Oct 9: 0 new sources (0 outlets, 0 accounts)
  • Oct 10: 0 new sources (0 outlets, 0 accounts)
  • Oct 11: 0 new sources (0 outlets, 0 accounts)
  • Oct 12: 0 new sources (0 outlets, 0 accounts)
  • Oct 13: 0 new sources (0 outlets, 0 accounts)
  • Oct 14: 0 new sources (0 outlets, 0 accounts)

Hourly attention

No comparable trend data