Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
9 results
Sep 4, 2026QAnything 2.0.0 contains an authentication bypass vulnerability in the /api/local_doc_qa/get_file_base64 and /api/local_doc_qa/get_doc endpoints that allows unaCVE-2026-85671 · Other software · netease-youdao · reported by VulnCheckHigh 8.7
QAnything 2.0.0 contains an authentication bypass vulnerability in the /api/local_doc_qa/get_file_base64 and /api/local_doc_qa/get_doc endpoints that allows unauthenticated attackers to access any uploaded file or document. Attackers can enumerate file identifiers through unauthenticated endpoints and retrieve base64-encoded files or parsed document chunks without ownership verification to disclose cross-tenant knowledge base content.
- Product
- QAnything
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A stored Cross-Site Scripting (XSS) vulnerability exists in netease-youdao/QAnything.CVE-2024-8027 · Other software · netease-youdao · reported by security@huntr.devMedium 6.1
A stored Cross-Site Scripting (XSS) vulnerability exists in netease-youdao/QAnything. Attackers can upload malicious knowledge files to the knowledge base, which can trigger XSS attacks during user chats. This vulnerability affects all versions prior to the fix.
- Product
- netease-youdao/qanything
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A Cross-Site Request Forgery (CSRF) vulnerability exists in the backend API of netease-youdao/qanything, as of commit d9ab8bc.CVE-2024-8026 · Other software · netease-youdao · reported by security@huntr.devHigh 8.1
A Cross-Site Request Forgery (CSRF) vulnerability exists in the backend API of netease-youdao/qanything, as of commit d9ab8bc. The backend server has overly permissive CORS headers, allowing all cross-origin calls. This vulnerability affects all backend endpoints, enabling actions such as creating, uploading, listing, deleting files, and managing knowledge bases.
- Product
- netease-youdao/qanything
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A CORS misconfiguration vulnerability exists in netease-youdao/qanything version 1.4.1.CVE-2024-8024 · Other software · netease-youdao · reported by security@huntr.devHigh 7.5
A CORS misconfiguration vulnerability exists in netease-youdao/qanything version 1.4.1. This vulnerability allows an attacker to bypass the Same-Origin Policy, potentially leading to sensitive information exposure. Properly implementing a restrictive CORS policy is crucial to prevent such security issues.
- Product
- netease-youdao/qanything
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A local file inclusion vulnerability exists in netease-youdao/qanything version v2.0.0.CVE-2024-12866 · Other software · netease-youdao · reported by security@huntr.devHigh 7.5
A local file inclusion vulnerability exists in netease-youdao/qanything version v2.0.0. This vulnerability allows an attacker to read arbitrary files on the file system, which can lead to remote code execution by retrieving private SSH keys, reading private files, source code, and configuration files.
- Product
- netease-youdao/qanything
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A Denial of Service (DoS) vulnerability was discovered in the file upload feature of netease-youdao/qanything version v2.0.0.CVE-2024-12864 · Other software · netease-youdao · reported by security@huntr.devHigh 7.5
A Denial of Service (DoS) vulnerability was discovered in the file upload feature of netease-youdao/qanything version v2.0.0. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. An attacker can exploit this vulnerability by sending a large filename, causing the server to become overwhelmed and unavailable for legitimate users. This attack does not require authentication, making it highly scalable and increasing the risk of exploitation.
- Product
- netease-youdao/qanything
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025HTTP Request Smuggling vulnerability in netease-youdao/qanything version 1.4.1 allows attackers to exploit inconsistencies in the interpretation of HTTP requestCVE-2024-10264 · Other software · netease-youdao · reported by security@huntr.devCritical 9.8
HTTP Request Smuggling vulnerability in netease-youdao/qanything version 1.4.1 allows attackers to exploit inconsistencies in the interpretation of HTTP requests between a proxy and a server. This can lead to unauthorized access, bypassing security controls, session hijacking, data leakage, and potentially arbitrary code execution.
- Product
- netease-youdao/qanything
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2024netease-youdao/qanything version 1.4.1 contains a vulnerability where unsafe data obtained from user input is concatenated in SQL queries, leading to SQL injectCVE-2024-7099 · Other software · netease-youdao · reported by security@huntr.devCritical 9.8
netease-youdao/qanything version 1.4.1 contains a vulnerability where unsafe data obtained from user input is concatenated in SQL queries, leading to SQL injection. The affected functions include `get_knowledge_base_name`, `from_status_to_status`, `delete_files`, and `get_file_by_status`. An attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially stealing information from the database. The issue is fixed in version 1.4.2.
- Product
- netease-youdao/qanything
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2024qanything_kernel/connector/database/mysql/mysql_client.py in qanything.ai QAnything before 1.2.0 allows SQL Injection.CVE-2024-25722 · Other software · Qanything · reported by MITRECritical 9.8
qanything_kernel/connector/database/mysql/mysql_client.py in qanything.ai QAnything before 1.2.0 allows SQL Injection.
- Product
- Qanything
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.