Vulnerabilities

TI-2024-07440 CVE-2024-8026 · GHSA-m62f-m76v-gfwr

CSRF due to overly permissive CORS headers in netease-youdao/qanything

HIGH 70

A Cross-Site Request Forgery (CSRF) vulnerability exists in the backend API of netease-youdao/qanything, as of commit d9ab8bc.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00246 Published 2025-03-20 No fix listed CWE-352

TI-2024-06574 CVE-2024-7099 · GHSA-vqmq-g46j-863w

SQL Injection in netease-youdao/qanything

HIGH 82

netease-youdao/qanything version 1.4.1 contains a vulnerability where unsafe data obtained from user input is concatenated in SQL queries, leading to SQL injection.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.00626 Published 2024-10-13 Fixed in 1.4.2 CWE-89

TI-2024-16923 CVE-2024-25722 · GHSA-68p8-j476-8w35

qanything_kernel/connector/database/mysql/mysql_client.py in qanything.ai QAnything before 1.2.0 allows SQL Injection.

MEDIUM 50

qanything_kernel/connector/database/mysql/mysql_client.py in qanything.ai QAnything before 1.2.0 allows SQL Injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00561 Published 2024-02-11 No fix listed CWE-89

Vulnerabilities

Filters

CSRF due to overly permissive CORS headers in netease-youdao/qanything

SQL Injection in netease-youdao/qanything

qanything_kernel/connector/database/mysql/mysql_client.py in qanything.ai QAnything before 1.2.0 allows SQL Injection.