CVE-2025-71452

MEDIUM 6.1

Vembu BDRSuite < 7.6.0 XSS via restoreprogress.sgp

CVSS Score

6.1

EPSS Score

0.0%

EPSS Percentile

0th

Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/clientside/restoreprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as mn, rnm, isRepliRestore, rusr, and rpwd that are reflected unsanitized into the HTML response. Attackers can craft malicious links to execute arbitrary JavaScript in a victim's browser session, enabling session hijacking or interface manipulation.

CWE	CWE-79
Vendor	vembu technologies
Product	bdrsuite
Published	Nov 3, 2026

Stay Ahead of the Next One

Get instant alerts for vembu technologies bdrsuite

Be the first to know when new medium vulnerabilities affecting vembu technologies bdrsuite are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

Vembu Technologies / BDRSuite

0 < 7.6.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

chocapikk.com: https://chocapikk.com/posts/2025/bdrsuite/ support.bdrshield.com: https://support.bdrshield.com/portal/en/kb/articles/release-notes vulncheck.com: https://www.vulncheck.com/advisories/vembu-bdrsuite-xss-via-restoreprogress-sgp

Credits

Valentin Lobstein (Chocapikk)