CVE-2025-51055
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
Insecure storage of credentials has been found in the /api_vedo/configuration/config.yml file in Vedo Suite version 2024.17. This file contains clear-text credentials, secret keys, and database information.
Risk Assessment
The organization is at risk of sensitive data exposure, which could lead to unauthorized access to systems and databases, as well as data theft or privilege escalation.
Recommendation
Immediately remove plaintext credentials from the config.yml file and use secure secret storage methods such as a password manager or encryption. Additionally, rotate all compromised keys and passwords.
Other vulnerabilities in Vedo Suite
See all- CVE-2026-51366Critical
SQL Injection vulnerability in Bottinelli Informatica Vedo Suite v1.2.5 allows a remote attacker to execute arbitrary code via the api_vedo/chat endpoint and the utente_chat parameter.
- CVE-2026-51367High
An issue in Bottinelli Informatica Vedo Suite v1.2.5 allows a remote attacker to obtain sensitive information via the api_vedo/chat endpoint and the utente_chat parameter.
- CVE-2025-51058Medium
An SSRF vulnerability in Vedo Suite 2024.17 allows authenticated attackers to send HTTP requests to arbitrary external paths via the "file" parameter in the /api_vedo/video/preview endpoint.
- CVE-2025-51057Medium
A local file inclusion (LFI) vulnerability in Vedo Suite version 2024.17 allows remote authenticated attackers to read arbitrary filesystem files by exploiting an unsanitized 'readfile()' function call in '/api_vedo/video/preview'.
- CVE-2025-51056High
An unrestricted file upload vulnerability in Vedo Suite 2024.17 allows remote authenticated attackers to write to arbitrary filesystem paths by exploiting the insecure 'uploadPreviews()' function in '/api_vedo/colorways_preview', ultimately resulting in remote code execution (RCE).
- CVE-2025-51054Medium
A vulnerability in Vedo Suite 2024.17 allows unauthenticated remote attackers to obtain a valid high-privilege JWT token by sending an empty HTTP POST request to the /autologin/ endpoint, due to incorrect access control.
- CVE-2025-51053Medium
A Cross-site scripting (XSS) vulnerability in /api_vedo/ in Vedo Suite version 2024.17 allows remote attackers to inject arbitrary JavaScript or HTML code, potentially leading to code execution in the victim's browser.
- CVE-2025-51052Medium
A path traversal vulnerability in Vedo Suite 2024.17 allows remote authenticated attackers to read arbitrary filesystem files by exploiting an unsanitized 'file_get_contents()' function call in '/api_vedo/template'.
Original NVD description (English source)
Insecure Data Storage of credentials has been found in /api_vedo/configuration/config.yml file in Vedo Suite version 2024.17. This file contains clear-text credentials, secret keys, and database information.