CVE-2025-51055

Insecure Data Storage of credentials has been found in /apivedo/configuration/config.yml file in Vedo Suite version 2024.17. This file contains clear-text credentials, secret keys, and database information...

CVE-2025-51054

The Vedo Suite 2024.17 (an enterprise software suite for the textile and design industry by Bottinelli Informatica) is vulnerable to an Incorrect Access Control flaw. A remote attacker can obtain a valid high-privilege JWT token without prior authentication by sending an empty HTTP POST request t...

CVE-2025-51054

Vedo Suite 2024.17 is vulnerable to Incorrect Access Control, which allows remote attackers to obtain a valid high privilege JWT token without prior authentication via sending an empty HTTP POST request to the /autologin/ API endpoint...

CVE-2025-51057: Improper Control of Filename for Include/Require Statement in PHP Program

A local file inclusion LFI vulnerability in Vedo Suite version 2024.17 allows remote authenticated attackers to read arbitrary filesystem files by exploiting an unsanitized 'readfile' function call in '/apivedo/video/preview'...

PT-2025-32219 · Unknown · Vedo Suite

Name of the Vulnerable Software and Affected Versions: Vedo Suite version 2024.17 Description: The application stores credentials in clear-text within the /api vedo/configuration/config.yml file. This file contains sensitive information, including credentials, secret keys, and database informatio...

CVE-2025-51056

An unrestricted file upload vulnerability in Vedo Suite version 2024.17 allows remote authenticated attackers to write to arbitrary filesystem paths by exploiting the insecure 'uploadPreviews' custom function in '/apivedo/colorwayspreview', ultimately resulting in remote code execution RCE...

PT-2025-32221 · Unknown · Vedo Suite

Name of the Vulnerable Software and Affected Versions: Vedo Suite version 2024.17 Description: A local file inclusion vulnerability exists in Vedo Suite version 2024.17. This issue allows remote authenticated attackers to read arbitrary filesystem files by exploiting an unsanitized readfile...

PT-2025-32218 · Unknown · Vedo Suite

Name of the Vulnerable Software and Affected Versions: Vedo Suite version 2024.17 Description: Vedo Suite 2024.17 is susceptible to an incorrect access control issue. This allows remote attackers to obtain a valid, high-privilege JWT JSON Web Token without authentication by sending an empty HTTP...

PT-2025-32216

Name of the Vulnerable Software and Affected Versions Vedo Suite version 2024.17 Description A path traversal issue exists in Vedo Suite 2024.17 that may allow remote authenticated attackers to read arbitrary filesystem files. The issue is due to an unsanitized file get contents function call...

CVE-2025-51058

Bottinelli Informatical Vedo Suite 2024.17 is vulnerable to Server-side Request Forgery SSRF in the /apivedo/video/preview endpoint, which allows remote authenticated attackers to trigger HTTP requests towards arbitrary remote paths via the "file" URL parameter...

CVE-2025-51053

A Cross-site scripting XSS vulnerability in /apivedo/ in Vedo Suite version 2024.17 allows remote attackers to inject arbitrary Javascript or HTML code and potentially trigger code execution in victim's browser...

Bottinelli Informatical Vedo Suite 安全漏洞

Bottinelli Informatical Vedo Suite is an enterprise software suite for the textile and design industry from Bottinelli Informatica, Italy. A cross-site scripting vulnerability exists in Bottinelli Informatical Vedo Suite version 2024.17, which originates from uncleared input in /apivedo/, and can...

CVE-2025-51054

Vedo Suite 2024.17 is vulnerable to Incorrect Access Control, which allows remote attackers to obtain a valid high privilege JWT token without prior authentication via sending an empty HTTP POST request to the /autologin/ API endpoint...

CVE-2025-51058

Bottinelli Informatical Vedo Suite 2024.17 is vulnerable to Server-side Request Forgery SSRF in the /apivedo/video/preview endpoint, which allows remote authenticated attackers to trigger HTTP requests towards arbitrary remote paths via the "file" URL parameter...

CVE-2025-51053: Improper Neutralization of Input During Web Page Generation

A Cross-site scripting XSS vulnerability in /apivedo/ in Vedo Suite version 2024.17 allows remote attackers to inject arbitrary Javascript or HTML code and potentially trigger code execution in victim's browser...

CVE-2025-51052

A path traversal vulnerability in Vedo Suite 2024.17 allows remote authenticated attackers to read arbitrary filesystem files by exploiting an unsanitized 'filegetcontents' function call in '/apivedo/template'...

Bottinelli Informatical Vedo Suite 安全漏洞

Bottinelli Informatical Vedo Suite is an enterprise software suite for the textile and design industry from Bottinelli Informatica, Italy. A file upload vulnerability exists in Bottinelli Informatical Vedo Suite version 2024.17, which stems from a lack of effective validation of uploaded files by...

CVE-2025-51056

The Vedo Suite version 2024.17 (by Bottinelli Informatica) contains an unrestricted file upload vulnerability. The root cause is a lack of effective validation within the insecure uploadPreviews() custom function located in the /api_vedo/colorways_preview endpoint. Remote authenticated attackers ...

CVE-2025-51058: Server-Side Request Forgery (SSRF)

Bottinelli Informatical Vedo Suite 2024.17 is vulnerable to Server-side Request Forgery SSRF in the /apivedo/video/preview endpoint, which allows remote authenticated attackers to trigger HTTP requests towards arbitrary remote paths via the "file" URL parameter...

CVE-2025-51056: Unrestricted Upload of File with Dangerous Type

An unrestricted file upload vulnerability in Vedo Suite version 2024.17 allows remote authenticated attackers to write to arbitrary filesystem paths by exploiting the insecure 'uploadPreviews' custom function in '/apivedo/colorwayspreview', ultimately resulting in remote code execution RCE...