CVE-2025-71451

MEDIUM 6.1

Vembu BDRSuite < 7.6.0 XSS via serverbackupprogress.sgp

CVSS Score

6.1

EPSS Score

0.0%

EPSS Percentile

0th

Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/serverside/serverbackupprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as ClientName, BackupName, and grpName that are interpolated unsanitized into loadXMLDoc() calls and reflected in AbortBackup() POST requests to dodeleteclientbackup.sgp. Attackers can craft malicious links or requests to execute arbitrary JavaScript in a victim's browser session, enabling session hijacking or interface manipulation.

CWE	CWE-79
Vendor	vembu technologies
Product	bdrsuite
Published	Nov 3, 2026

Stay Ahead of the Next One

Get instant alerts for vembu technologies bdrsuite

Be the first to know when new medium vulnerabilities affecting vembu technologies bdrsuite are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

Vembu Technologies / BDRSuite

0 < 7.6.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

chocapikk.com: https://chocapikk.com/posts/2025/bdrsuite/ support.bdrshield.com: https://support.bdrshield.com/portal/en/kb/articles/release-notes vulncheck.com: https://www.vulncheck.com/advisories/vembu-bdrsuite-xss-via-serverbackupprogress-sgp

Credits

Valentin Lobstein (Chocapikk)