CVE-2026-51366
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
SQL Injection vulnerability in Bottinelli Informatica Vedo Suite v1.2.5 allows a remote attacker to execute arbitrary code via the api_vedo/chat endpoint and the utente_chat parameter.
Risk Assessment
SQL injection may allow an attacker to manipulate the database, steal data, or execute arbitrary code, posing a serious security threat.
Recommendation
Update Vedo Suite to the latest version or apply patches that address the SQL injection vulnerability.
Other vulnerabilities in Vedo Suite
See all- CVE-2026-51367High
An issue in Bottinelli Informatica Vedo Suite v1.2.5 allows a remote attacker to obtain sensitive information via the api_vedo/chat endpoint and the utente_chat parameter.
- CVE-2025-51058Medium
An SSRF vulnerability in Vedo Suite 2024.17 allows authenticated attackers to send HTTP requests to arbitrary external paths via the "file" parameter in the /api_vedo/video/preview endpoint.
- CVE-2025-51057Medium
A local file inclusion (LFI) vulnerability in Vedo Suite version 2024.17 allows remote authenticated attackers to read arbitrary filesystem files by exploiting an unsanitized 'readfile()' function call in '/api_vedo/video/preview'.
- CVE-2025-51056High
An unrestricted file upload vulnerability in Vedo Suite 2024.17 allows remote authenticated attackers to write to arbitrary filesystem paths by exploiting the insecure 'uploadPreviews()' function in '/api_vedo/colorways_preview', ultimately resulting in remote code execution (RCE).
- CVE-2025-51055High
Insecure storage of credentials has been found in the /api_vedo/configuration/config.yml file in Vedo Suite version 2024.17. This file contains clear-text credentials, secret keys, and database information.
- CVE-2025-51054Medium
A vulnerability in Vedo Suite 2024.17 allows unauthenticated remote attackers to obtain a valid high-privilege JWT token by sending an empty HTTP POST request to the /autologin/ endpoint, due to incorrect access control.
- CVE-2025-51053Medium
A Cross-site scripting (XSS) vulnerability in /api_vedo/ in Vedo Suite version 2024.17 allows remote attackers to inject arbitrary JavaScript or HTML code, potentially leading to code execution in the victim's browser.
- CVE-2025-51052Medium
A path traversal vulnerability in Vedo Suite 2024.17 allows remote authenticated attackers to read arbitrary filesystem files by exploiting an unsanitized 'file_get_contents()' function call in '/api_vedo/template'.
Original NVD description (English source)
SQL Injection vulnerability in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to execute arbitrary code via the api_vedo/chat endpoint and the utente_chat parameter
Vulnerability data from NVD (NIST) · CISA KEV · EPSS