SQL Injection vulnerability in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to execute arbitrary code via the api_vedo/chat… (CVE-2026-51366)

The Bottinelli Informatica Vedo Suite v1.2.5 contains a SQL Injection vulnerability in the api_vedo/chat endpoint. An attacker can leverage the utente_chat parameter to inject malicious SQL commands, potentially leading to arbitrary code execution on the affected system. The vulnerability is identified as CVE-2026-51366. No CVSS score or detailed impact metrics are provided. No affected versions beyond v1.2.5 are explicitly stated, and no vendor advisory or patch information is available.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system, potentially compromising data integrity, confidentiality, and system availability. However, no known exploits are reported in the wild, and the extent of impact depends on the deployment context and attacker capabilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider restricting access to the vulnerable endpoint and monitor for suspicious activity related to the api_vedo/chat endpoint. Avoid relying on generic mitigations unless specifically recommended by the vendor.