PT-2025-32218 · Unknown · Vedo Suite

Name of the Vulnerable Software and Affected Versions: Vedo Suite version 2024.17 Description: Vedo Suite 2024.17 is susceptible to an incorrect access control issue. This allows remote attackers to obtain a valid, high-privilege JWT JSON Web Token without authentication by sending an empty HTTP...

PT-2025-32220 · Unknown · Vedo Suite

Name of the Vulnerable Software and Affected Versions: Vedo Suite version 2024.17 Description: An unrestricted file upload issue exists in Vedo Suite version 2024.17. Remote authenticated attackers can write to arbitrary filesystem paths by exploiting the insecure uploadPreviews custom function i...

CVE-2025-51054

Vedo Suite 2024.17 is affected by an Incorrect Access Control vulnerability that lets remote attackers obtain a valid high‑privilege JWT token without authentication by sending an empty POST to the /autologin/ endpoint. The issue’s impact is elevated privileges via a JWT; affected software is Ved...

CVE-2025-51052

A path traversal vulnerability in Vedo Suite 2024.17 allows remote authenticated attackers to read arbitrary filesystem files by exploiting an unsanitized 'filegetcontents' function call in '/apivedo/template'...

PT-2025-32217 · Unknown · Vedo Suite

Name of the Vulnerable Software and Affected Versions: Vedo Suite version 2024.17 Description: A Cross-site scripting XSS vulnerability exists in the /api vedo/ API endpoint of Vedo Suite. This allows remote attackers to inject arbitrary Javascript or HTML code, potentially leading to code...

CVE-2025-51056

An unrestricted file upload vulnerability in Vedo Suite version 2024.17 allows remote authenticated attackers to write to arbitrary filesystem paths by exploiting the insecure 'uploadPreviews' custom function in '/apivedo/colorwayspreview', ultimately resulting in remote code execution RCE...

CVE-2025-51058

Bottinelli Informatical Vedo Suite 2024.17 is vulnerable to Server-side Request Forgery SSRF in the /apivedo/video/preview endpoint, which allows remote authenticated attackers to trigger HTTP requests towards arbitrary remote paths via the "file" URL parameter...

CVE-2025-51055

CVE-2025-51055 refers to an information disclosure in Vedo Suite 2024.17 where credentials, keys, and database details are stored in plaintext in /api_vedo/configuration/config.yml. Multiple connected sources corroborate this: the CVE description (NVD/Red Hat/CVE lists) and the PT-2025-32219 advi...

CVE-2025-51054

Vedo Suite 2024.17 is vulnerable to Incorrect Access Control, which allows remote attackers to obtain a valid high privilege JWT token without prior authentication via sending an empty HTTP POST request to the /autologin/ API endpoint...

CVE-2025-51053

A Cross-site scripting XSS vulnerability in /apivedo/ in Vedo Suite version 2024.17 allows remote attackers to inject arbitrary Javascript or HTML code and potentially trigger code execution in victim's browser...

CVE-2025-51058

The CVE-2025-51058 issue affects Bottinelli Informatical Vedo Suite 2024.17. The vulnerability is a Server-Side Request Forgery (SSRF) in the /api_vedo/video/preview endpoint, where an authenticated remote attacker can cause HTTP requests to arbitrary remote paths by supplying a file URL paramete...

CVE-2025-51055

Insecure Data Storage of credentials has been found in /apivedo/configuration/config.yml file in Vedo Suite version 2024.17. This file contains clear-text credentials, secret keys, and database information...

CVE-2025-51058

Bottinelli Informatical Vedo Suite 2024.17 is vulnerable to Server-side Request Forgery SSRF in the /apivedo/video/preview endpoint, which allows remote authenticated attackers to trigger HTTP requests towards arbitrary remote paths via the "file" URL parameter...

Bottinelli Informatical Vedo Suite 安全漏洞

Bottinelli Informatical Vedo Suite is an enterprise software suite for the textile and design industry from Bottinelli Informatica, Italy. A file inclusion vulnerability exists in Bottinelli Informatical Vedo Suite, which stems from an uncleaned readfile function call that can be exploited by an...

Bottinelli Informatical Vedo Suite 安全漏洞

Bottinelli Informatical Vedo Suite is an enterprise software suite for the textile and design industry from Bottinelli Informatica, Italy. An access control error vulnerability exists in Bottinelli Informatical Vedo Suite, which can be exploited by an attacker to obtain an elevated privilege JWT...

Bottinelli Informatical Vedo Suite 安全漏洞

Bottinelli Informatical Vedo Suite is an enterprise software suite for the textile and design industry from Bottinelli Informatica, Italy. A file upload vulnerability exists in Bottinelli Informatical Vedo Suite version 2024.17, which stems from a lack of effective validation of uploaded files by...

CVE-2025-51052

CVE-2025-51052 describes a path traversal vulnerability in Vedo Suite 2024.17 where an unsanitized file_get_contents() call in /api_vedo/template allows remote authenticated users to read arbitrary filesystem files. Technical details across connected sources confirm the root cause is improper san...

Bottinelli Informatical Vedo Suite 安全漏洞

Bottinelli Informatical Vedo Suite is an enterprise software suite for the textile and design industry from Bottinelli Informatica, Italy. An information disclosure vulnerability exists in Bottinelli Informatical Vedo Suite, which stems from plaintext credentials stored in the...

CVE-2025-51056

CVE-2025-51056 describes an Unrestricted File Upload in Bottinelli Informatical Vedo Suite 2024.17, exploitable via the insecure uploadPreviews() function at /api_vedo/colorways_preview. The vulnerability allows remote authenticated attackers to write to arbitrary filesystem paths and can lead to...

PT-2025-32219 · Unknown · Vedo Suite

Name of the Vulnerable Software and Affected Versions: Vedo Suite version 2024.17 Description: The application stores credentials in clear-text within the /api vedo/configuration/config.yml file. This file contains sensitive information, including credentials, secret keys, and database informatio...