Vedo Suite CVE-2026-51366

Exploitation requires network reach to the Vedo Suite application and a low-privilege authenticated context (CVSS PR:L), specifically the ability to invoke the api_vedo/chat endpoint and supply attacker-controlled input in the utente_chat parameter. No user interaction is required (UI:N) and attack complexity is low (AC:L). Limiting factors: the attacker must first hold or acquire valid low-level credentials or an authenticated session, and the instance must be reachable - an internet-exposed, authenticated Vedo Suite deployment is the realistic worst case, while internal-only deployments substantially reduce exposure. The SQLi-to-RCE escalation may further depend on database privileges and configuration that permit OS-level command execution or file writes.

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C, all-High impact) describes a network-reachable, low-complexity flaw needing only low-privilege authentication, with a scope change reflecting the SQLi-to-RCE pivot - hence the near-maximum 9.9. Counterbalancing this, EPSS is only 0.29% (22nd percentile), the CVE is not on CISA KEV, and no proof-of-concept or exploit code is referenced, so there is no evidence of active or imminent mass exploitation. The signals are therefore somewhat in tension: severity-per-instance is very high, but real-world exploitation pressure is currently low, likely because the product's deployment footprint is small and the chat endpoint requires prior authentication. For an organization that actually runs Vedo Suite, the low EPSS should not be read as reassurance - an authenticated SQLi-to-RCE on an internet-exposed instance is a genuine priority to remediate promptly, whereas organizations that do not run this product can safely deprioritize it. Note the PR:L requirement: an attacker needs at least a low-privilege account or a way to reach an authenticated context, which is a meaningful limiting factor worth verifying against the actual deployment.

An attacker who has obtained or registered a low-privilege Vedo Suite account (or reaches an authenticated session) sends a crafted request to the api_vedo/chat endpoint with a malicious payload in the utente_chat parameter. The injected SQL is executed by the backend database and, per the referenced analysis, is leveraged to write or execute code on the host, giving the attacker control of the application server. No public exploit code is referenced at time of analysis, and low CVSS attack complexity means a working exploit would be reliable once developed.