Vedo Suite Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in Vedo Suite version 2024.17, specifically within the '/api_vedo/' endpoint. This vulnerability allows remote attackers to inject arbitrary JavaScript or HTML, which could potentially be executed in the context of the victim's browser.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a GET request to the '/api_vedo/' endpoint with a payload that includes a script tag, such as '<script>alert("XSS")</script>'. Alternatively, the same payload can be injected into the 'file' parameter of the '/api_vedo/video/preview' endpoint.

Remediation

Users are advised to update to Vedo Suite version 2025.07, where this vulnerability has been patched.