Bottinelli Informatical Vedo Suite 安全漏洞

Bottinelli Informatical Vedo Suite is an enterprise software suite for the textile and design industry from Bottinelli Informatica, Italy. An access control error vulnerability exists in Bottinelli Informatical Vedo Suite, which can be exploited by an attacker to obtain an elevated privilege JWT...

Bottinelli Informatical Vedo Suite 安全漏洞

Bottinelli Informatical Vedo Suite is an enterprise software suite for the textile and design industry from Bottinelli Informatica, Italy. A file upload vulnerability exists in Bottinelli Informatical Vedo Suite version 2024.17, which stems from a lack of effective validation of uploaded files by...

CVE-2025-51056

CVE-2025-51056 describes an Unrestricted File Upload in Bottinelli Informatical Vedo Suite 2024.17, exploitable via the insecure uploadPreviews() function at /api_vedo/colorways_preview. The vulnerability allows remote authenticated attackers to write to arbitrary filesystem paths and can lead to...

CVE-2025-51054

Vedo Suite 2024.17 is vulnerable to Incorrect Access Control, which allows remote attackers to obtain a valid high privilege JWT token without prior authentication via sending an empty HTTP POST request to the /autologin/ API endpoint...

Bottinelli Informatical Vedo Suite 安全漏洞

Bottinelli Informatical Vedo Suite is an enterprise software suite for the textile and design industry from Bottinelli Informatica, Italy. An information disclosure vulnerability exists in Bottinelli Informatical Vedo Suite, which stems from plaintext credentials stored in the...

Bottinelli Informatical Vedo Suite 安全漏洞

Bottinelli Informatical Vedo Suite is an enterprise software suite for the textile and design industry from Bottinelli Informatica, Italy. A file inclusion vulnerability exists in Bottinelli Informatical Vedo Suite, which stems from an uncleaned readfile function call that can be exploited by an...

CVE-2025-51058

The CVE-2025-51058 issue affects Bottinelli Informatical Vedo Suite 2024.17. The vulnerability is a Server-Side Request Forgery (SSRF) in the /api_vedo/video/preview endpoint, where an authenticated remote attacker can cause HTTP requests to arbitrary remote paths by supplying a file URL paramete...

PT-2025-32219 · Unknown · Vedo Suite

Name of the Vulnerable Software and Affected Versions: Vedo Suite version 2024.17 Description: The application stores credentials in clear-text within the /api vedo/configuration/config.yml file. This file contains sensitive information, including credentials, secret keys, and database informatio...

CVE-2025-51052

CVE-2025-51052 describes a path traversal vulnerability in Vedo Suite 2024.17 where an unsanitized file_get_contents() call in /api_vedo/template allows remote authenticated users to read arbitrary filesystem files. Technical details across connected sources confirm the root cause is improper san...

PT-2025-32222 · Bottinelli Informatical · Vedo Suite

Name of the Vulnerable Software and Affected Versions: Bottinelli Informatical Vedo Suite version 2024.17 Description: Bottinelli Informatical Vedo Suite 2024.17 is vulnerable to Server-side Request Forgery SSRF in the /api vedo/video/preview endpoint. This allows remote authenticated attackers t...

Bottinelli Informatical Vedo Suite 安全漏洞

Bottinelli Informatical Vedo Suite is an enterprise software suite for the textile and design industry from Bottinelli Informatica, Italy. Bottinelli Informatical Vedo Suite suffers from a server-side request forgery vulnerability, which originates from the /apivedo/video/preview endpoint that do...

PT-2025-32221 · Unknown · Vedo Suite

Name of the Vulnerable Software and Affected Versions: Vedo Suite version 2024.17 Description: A local file inclusion vulnerability exists in Vedo Suite version 2024.17. This issue allows remote authenticated attackers to read arbitrary filesystem files by exploiting an unsanitized readfile...

CVE-2025-51052

A path traversal vulnerability in Vedo Suite 2024.17 allows remote authenticated attackers to read arbitrary filesystem files by exploiting an unsanitized 'filegetcontents' function call in '/apivedo/template'...

CVE-2025-51057

A local file inclusion LFI vulnerability in Vedo Suite version 2024.17 allows remote authenticated attackers to read arbitrary filesystem files by exploiting an unsanitized 'readfile' function call in '/apivedo/video/preview'...

PT-2025-32216 · Unknown · Vedo Suite

Name of the Vulnerable Software and Affected Versions: Vedo Suite version 2024.17 Description: A path traversal issue exists in Vedo Suite 2024.17 that may allow remote authenticated attackers to read arbitrary filesystem files. The issue is due to an unsanitized file get contents function call...

CVE-2025-51055

Insecure Data Storage of credentials has been found in /apivedo/configuration/config.yml file in Vedo Suite version 2024.17. This file contains clear-text credentials, secret keys, and database information...

Bottinelli Informatical Vedo Suite 安全漏洞

Bottinelli Informatical Vedo Suite is an enterprise software suite for the textile and design industry from Bottinelli Informatica, Italy. A cross-site scripting vulnerability exists in Bottinelli Informatical Vedo Suite version 2024.17, which originates from uncleared input in /apivedo/, and can...

CVE-2025-51053

A Cross-site scripting XSS vulnerability in /apivedo/ in Vedo Suite version 2024.17 allows remote attackers to inject arbitrary Javascript or HTML code and potentially trigger code execution in victim's browser...

CVE-2025-51057

The CVE-2025-51057 entry describes a local file inclusion (LFI) in Bottinelli/Vedo Suite 2024.17 via the /api_vedo/video/preview endpoint. The root cause is an unsanitized readfile() call that lets an authenticated attacker read arbitrary filesystem files. Impact is read access to sensitive files...

The vulnerability of the Zimbra Collaboration Suite’s corporate email management system, related to the lack of measures taken to protect the website structure, allows attackers to perform cross-site scripting attacks.

The vulnerability of the Zimbra Collaboration Suite email management system is related to the lack of measures taken to protect the website structure when importing files into the portfolio. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...