CVE-2024-8027

6.1 mediumEPSS 0.4%

Medium (6.1) in youdao qanything. EPSS 0.4% chance of exploitation in the next 30 days.

A stored Cross-Site Scripting (XSS) vulnerability exists in netease-youdao/QAnything. Attackers can upload malicious knowledge files to the knowledge base, which can trigger XSS attacks during user chats. This vulnerability affects all versions prior to the fix.

Severity

CVSS 3.0

6.1 medium

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 29% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2025-03-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

youdao:qanything

References

https://huntr.com/bounties/cf75f024-3d64-416d-adfe-c4255d7c3f34

Check your stack JSON