CVE-2026-51366: SQL Injection
SQL Injection vulnerability in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to execute arbitrary code via the apivedo/chat endpoint and the utentechat parameter
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to target this issue?
The reported attack vector is remote access to the api_vedo/chat endpoint with control over the utente_chat parameter. The available data does not state whether authentication or any particular privileges are required.
Which version is identified as affected?
The vulnerability is reported in Bottinelli Informatica Vedo Suite version 1.2.5. No fixed version or affected-version range is provided.
How can I determine whether my deployment may be exposed?
Verify whether the deployment runs Vedo Suite 1.2.5 and whether the api_vedo/chat endpoint is remotely reachable. Review application and database logs for suspicious or unexpected values submitted through the utente_chat parameter.