CVE-2025-51054
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
A vulnerability in Vedo Suite 2024.17 allows unauthenticated remote attackers to obtain a valid high-privilege JWT token by sending an empty HTTP POST request to the /autologin/ endpoint, due to incorrect access control.
Risk Assessment
An attacker can gain full control over the Vedo Suite system, accessing sensitive data and administrative functions without authentication.
Recommendation
Immediately update Vedo Suite to the latest version and enable multi-factor authentication for all administrative accounts.
Other vulnerabilities in Vedo Suite
See all- CVE-2026-51366Critical
SQL Injection vulnerability in Bottinelli Informatica Vedo Suite v1.2.5 allows a remote attacker to execute arbitrary code via the api_vedo/chat endpoint and the utente_chat parameter.
- CVE-2026-51367High
An issue in Bottinelli Informatica Vedo Suite v1.2.5 allows a remote attacker to obtain sensitive information via the api_vedo/chat endpoint and the utente_chat parameter.
- CVE-2025-51058Medium
An SSRF vulnerability in Vedo Suite 2024.17 allows authenticated attackers to send HTTP requests to arbitrary external paths via the "file" parameter in the /api_vedo/video/preview endpoint.
- CVE-2025-51057Medium
A local file inclusion (LFI) vulnerability in Vedo Suite version 2024.17 allows remote authenticated attackers to read arbitrary filesystem files by exploiting an unsanitized 'readfile()' function call in '/api_vedo/video/preview'.
- CVE-2025-51056High
An unrestricted file upload vulnerability in Vedo Suite 2024.17 allows remote authenticated attackers to write to arbitrary filesystem paths by exploiting the insecure 'uploadPreviews()' function in '/api_vedo/colorways_preview', ultimately resulting in remote code execution (RCE).
- CVE-2025-51055High
Insecure storage of credentials has been found in the /api_vedo/configuration/config.yml file in Vedo Suite version 2024.17. This file contains clear-text credentials, secret keys, and database information.
- CVE-2025-51053Medium
A Cross-site scripting (XSS) vulnerability in /api_vedo/ in Vedo Suite version 2024.17 allows remote attackers to inject arbitrary JavaScript or HTML code, potentially leading to code execution in the victim's browser.
- CVE-2025-51052Medium
A path traversal vulnerability in Vedo Suite 2024.17 allows remote authenticated attackers to read arbitrary filesystem files by exploiting an unsanitized 'file_get_contents()' function call in '/api_vedo/template'.
Original NVD description (English source)
Vedo Suite 2024.17 is vulnerable to Incorrect Access Control, which allows remote attackers to obtain a valid high privilege JWT token without prior authentication via sending an empty HTTP POST request to the /autologin/ API endpoint.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS