Vulnerabilities

TI-2024-11923 CVE-2024-12866 · GHSA-6ch3-c5vc-j2r6

Local File Inclusion in netease-youdao/qanything

HIGH 74

A local file inclusion vulnerability exists in netease-youdao/qanything version v2.0.0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01518 Published 2025-03-20 No fix listed CWE-22

TI-2024-11922 CVE-2024-12864 · GHSA-w3m9-crxx-972f

Unauthenticated DoS by Sending Large Filename at File Upload Endpoint in netease-youdao/qanything

HIGH 72

A Denial of Service (DoS) vulnerability was discovered in the file upload feature of netease-youdao/qanything version v2.0.0.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00878 Published 2025-03-20 No fix listed CWE-400

TI-2024-07441 CVE-2024-8027 · GHSA-rv4f-crjq-xjf8

Stored Cross-Site Scripting (XSS) in netease-youdao/QAnything

MEDIUM 60

A stored Cross-Site Scripting (XSS) vulnerability exists in netease-youdao/QAnything.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00356 Published 2025-03-20 No fix listed CWE-79

TI-2024-07438 CVE-2024-8024 · GHSA-h35f-g2pq-8xq7

CORS Misconfiguration in netease-youdao/qanything

HIGH 72

A CORS misconfiguration vulnerability exists in netease-youdao/qanything version 1.4.1.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00317 Published 2025-03-20 No fix listed CWE-346

TI-2024-09510 CVE-2024-10264 · GHSA-jx9r-x782-9r4m

HTTP Request Smuggling in netease-youdao/qanything

HIGH 81

HTTP Request Smuggling vulnerability in netease-youdao/qanything version 1.4.1 allows attackers to exploit inconsistencies in the interpretation of HTTP requests between a proxy and a server.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00955 Published 2025-03-20 No fix listed CWE-444