CVE-2024-7099

netease-youdao/qanything version 1.4.1 contains a vulnerability where unsafe data obtained from user input is concatenated in SQL queries, leading to SQL injection. The affected functions include `get_knowledge_base_name`, `from_status_to_status`, `delete_files`, and `get_file_by_status`. An attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially stealing information from the database. The issue is fixed in version 1.4.2.

• CWE-89

• https://github.com/netease-youdao/qanything/commit/a87354f09d93e95350fb45eb343dc75454387554Patch
• https://huntr.com/bounties/bc98983e-06cc-4a4b-be01-67e5010cb2c1Exploit, Third Party Advisory

Published

Oct 13, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-7093Dispatch's notification service uses Jinja templates to gene…9.4
• CVE-2024-7094The JS Help Desk – The Ultimate Help Desk & Support Plugin p…9.8
• CVE-2024-7095On affected platforms running Arista EOS with SNMP configure…4.3
• CVE-2024-7096A privilege escalation vulnerability exists in multiple WSO2…5.4
• CVE-2024-7097An incorrect authorization vulnerability exists in multiple …4.3
• CVE-2024-7098Improper Restriction of XML External Entity Reference vulner…9.8
• CVE-2024-7100The Bold Page Builder plugin for WordPress is vulnerable to …5.4
• CVE-2024-7101A vulnerability, which was classified as critical, has been …7.3
• CVE-2024-7102An issue was discovered in GitLab CE/EE affecting all versio…7.5
• CVE-2024-7103A reflected cross-site scripting (XSS) vulnerability exists …5.4
• CVE-2024-7104Improper Control of Generation of Code ('Code Injection') vu…9.8
• CVE-2024-7105A vulnerability classified as critical has been found in For…8.8