CVE-2026-51366

9.9 criticalEPSS 0.8%

Critical (9.9). EPSS 0.8% chance of exploitation in the next 30 days.

SQL Injection vulnerability in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to execute arbitrary code via the api_vedo/chat endpoint and the utente_chat parameter

Severity

CVSS 3.1

9.9 critical

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 56% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2026-08-19
Modified: 2026-09-09
Record from: the NVD, synced 2026-10-19

References

https://blog.elmec.com/cve-2026-51366-sql-injection-leading-to-remote-code-execution
https://www.bottinelliinformatica.it/it/vedo-suite/
https://www.cybergon.com/

Check your stack JSON