Critical severity9.8NVD Advisory· Published Oct 13, 2024· Updated Jun 17, 2026
CVE-2024-7099
CVE-2024-7099
Description
netease-youdao/qanything version 1.4.1 contains a vulnerability where unsafe data obtained from user input is concatenated in SQL queries, leading to SQL injection. The affected functions include get_knowledge_base_name, from_status_to_status, delete_files, and get_file_by_status. An attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially stealing information from the database. The issue is fixed in version 1.4.2.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: <=1.4.1
- Range: unspecified
Patches
Vulnerability mechanics
References
2- github.com/netease-youdao/qanything/commit/a87354f09d93e95350fb45eb343dc75454387554nvdPatch
- huntr.com/bounties/bc98983e-06cc-4a4b-be01-67e5010cb2c1nvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.