CVE-2024-25722

CRITICAL

QAnything < 1.2.0 - SQL Injection via MySQL Client

Title source: llm

qanything_kernel/connector/database/mysql/mysql_client.py in qanything.ai QAnything before 1.2.0 allows SQL Injection.

Core 2

Core References

Patch

Issue Tracking

CVSS v3 9.8

EPSS 0.0056

EPSS Percentile 42.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

CWE

CWE-89

Status published

Products (1)

qanything/qanything < 1.2.0

Published Feb 11, 2024

Tracked Since Feb 18, 2026