Advisories · Technology

netease-youdao QAnything.

Every CVE that names netease-youdao QAnything among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-85671 CVE record

CVSS 8.7 High

QAnything 2.0.0 Unauthenticated Cross-User File Disclosure
- netease-youdao QAnything
- Authentication bypass
Not analysed yet 4 Sept 2026
CVE-2024-12866 CVE record

CVSS 7.5 High

Local File Inclusion in netease-youdao/qanything
- netease-youdao/qanything
- Path traversal
Not analysed yet 20 Mar 2025
CVE-2024-8026 CVE record

CVSS 8.1 High

CSRF due to overly permissive CORS headers in netease-youdao/qanything
- netease-youdao/qanything
- Cross-site request forgery (CSRF)
Not analysed yet 20 Mar 2025
CVE-2024-12864 CVE record

CVSS 7.5 High

Unauthenticated DoS by Sending Large Filename at File Upload Endpoint in netease-youdao/qanything
- netease-youdao/qanything
- Denial of service
Not analysed yet 20 Mar 2025
CVE-2024-8027 CVE record

CVSS 6.1 Medium

Stored Cross-Site Scripting (XSS) in netease-youdao/QAnything
- netease-youdao/qanything
- Cross-site scripting (XSS)
Not analysed yet 20 Mar 2025
CVE-2024-8024 CVE record

CVSS 7.5 High

CORS Misconfiguration in netease-youdao/qanything
- netease-youdao/qanything
- CWE-346
Not analysed yet 20 Mar 2025
CVE-2024-10264 CVE record

CVSS 7.5 High

HTTP Request Smuggling in netease-youdao/qanything
- netease-youdao/qanything
- HTTP request smuggling
Not analysed yet 20 Mar 2025
CVE-2024-7099 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

SQL Injection in netease-youdao/qanything
- netease-youdao/qanything
- SQL injection
Not analysed yet 13 Oct 2024