Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6

Export CSV
CVE-2026-85671

QAnything 2.0.0 Unauthenticated Cross-User File Disclosure

QAnything 2.0.0 contains an authentication bypass vulnerability in the /api/local_doc_qa/get_file_base64 and /api/local_doc_qa/get_doc endpoints that allows unauthenticated attackers to access any uploaded file or document. Attackers can enumerate file identifiers through unauthenticated endpoints and retrieve base64-encoded files or parsed document chunks without ownership verification to disclose cross-tenant knowledge base content.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Netease Youdao
Products
Qanything Qanything
CVE-2024-10264

HTTP Request Smuggling in netease-youdao/qanything

HTTP Request Smuggling vulnerability in netease-youdao/qanything version 1.4.1 allows attackers to exploit inconsistencies in the interpretation of HTTP requests between a proxy and a server. This can lead to unauthorized access, bypassing security controls, session hijacking, data leakage, and potentially arbitrary code execution.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Youdao
Products
Qanything
CVE-2024-12864

Unauthenticated DoS by Sending Large Filename at File Upload Endpoint in netease-youdao/qanything

A Denial of Service (DoS) vulnerability was discovered in the file upload feature of netease-youdao/qanything version v2.0.0. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. An attacker can exploit this vulnerability by sending a large filename, causing the server to become overwhelmed and unavailable for legitimate users. This attack does not require authentication, making it highly scalable and increasing the risk of exploitation.

CVSS 3.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Youdao
Products
Qanything
CVE-2024-8027

Stored Cross-Site Scripting (XSS) in netease-youdao/QAnything

A stored Cross-Site Scripting (XSS) vulnerability exists in netease-youdao/QAnything. Attackers can upload malicious knowledge files to the knowledge base, which can trigger XSS attacks during user chats. This vulnerability affects all versions prior to the fix.

CVSS 3.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Youdao
Products
Qanything
CVE-2024-8024

CORS Misconfiguration in netease-youdao/qanything

A CORS misconfiguration vulnerability exists in netease-youdao/qanything version 1.4.1. This vulnerability allows an attacker to bypass the Same-Origin Policy, potentially leading to sensitive information exposure. Properly implementing a restrictive CORS policy is crucial to prevent such security issues.

CVSS 3.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Youdao
Products
Qanything
CVE-2024-12866

Local File Inclusion in netease-youdao/qanything

A local file inclusion vulnerability exists in netease-youdao/qanything version v2.0.0. This vulnerability allows an attacker to read arbitrary files on the file system, which can lead to remote code execution by retrieving private SSH keys, reading private files, source code, and configuration files.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Youdao
Products
Qanything