Vedo Suite Project

Vedo Suite

7 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.5

CVE-2025-51052

Exploit
  • EPSS 0.16%
  • Veröffentlicht 06.08.2025 00:00:00
  • Zuletzt bearbeitet 09.10.2025 17:35:47

A path traversal vulnerability in Vedo Suite 2024.17 allows remote authenticated attackers to read arbitrary filesystem files by exploiting an unsanitized 'file_get_contents()' function call in '/api_vedo/template'.

6.1

CVE-2025-51053

Exploit
  • EPSS 0.11%
  • Veröffentlicht 06.08.2025 00:00:00
  • Zuletzt bearbeitet 09.10.2025 17:35:56

A Cross-site scripting (XSS) vulnerability in /api_vedo/ in Vedo Suite version 2024.17 allows remote attackers to inject arbitrary Javascript or HTML code and potentially trigger code execution in victim's browser.

6.5

CVE-2025-51054

Exploit
  • EPSS 0.13%
  • Veröffentlicht 06.08.2025 00:00:00
  • Zuletzt bearbeitet 09.10.2025 17:36:03

Vedo Suite 2024.17 is vulnerable to Incorrect Access Control, which allows remote attackers to obtain a valid high privilege JWT token without prior authentication via sending an empty HTTP POST request to the /autologin/ API endpoint.

8.6

CVE-2025-51055

Exploit
  • EPSS 0.03%
  • Veröffentlicht 06.08.2025 00:00:00
  • Zuletzt bearbeitet 09.10.2025 17:36:10

Insecure Data Storage of credentials has been found in /api_vedo/configuration/config.yml file in Vedo Suite version 2024.17. This file contains clear-text credentials, secret keys, and database information.

8.2

CVE-2025-51056

Exploit
  • EPSS 0.14%
  • Veröffentlicht 06.08.2025 00:00:00
  • Zuletzt bearbeitet 09.10.2025 17:36:18

An unrestricted file upload vulnerability in Vedo Suite version 2024.17 allows remote authenticated attackers to write to arbitrary filesystem paths by exploiting the insecure 'uploadPreviews()' custom function in '/api_vedo/colorways_preview', ultim...

6.5

CVE-2025-51057

Exploit
  • EPSS 0.08%
  • Veröffentlicht 06.08.2025 00:00:00
  • Zuletzt bearbeitet 09.10.2025 17:36:23

A local file inclusion (LFI) vulnerability in Vedo Suite version 2024.17 allows remote authenticated attackers to read arbitrary filesystem files by exploiting an unsanitized 'readfile()' function call in '/api_vedo/video/preview'.

6.5

CVE-2025-51058

Exploit
  • EPSS 0.07%
  • Veröffentlicht 06.08.2025 00:00:00
  • Zuletzt bearbeitet 09.10.2025 17:36:29

Bottinelli Informatical Vedo Suite 2024.17 is vulnerable to Server-side Request Forgery (SSRF) in the /api_vedo/video/preview endpoint, which allows remote authenticated attackers to trigger HTTP requests towards arbitrary remote paths via the "file"...