CVE-2025-71451
Received Received - Intake

Unauthenticated XSS in Vembu BDRSuite

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: VulnCheck

Description
Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/serverside/serverbackupprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as ClientName, BackupName, and grpName that are interpolated unsanitized into loadXMLDoc() calls and reflected in AbortBackup() POST requests to dodeleteclientbackup.sgp. Attackers can craft malicious links or requests to execute arbitrary JavaScript in a victim's browser session, enabling session hijacking or interface manipulation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2025-71451
EUVD
EUVD-2025-211247

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Vembu Technologies BDRSuite 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2025-71451 is an unauthenticated cross-site scripting (XSS) vulnerability in Vembu BDRSuite versions before 7.6.0. It allows remote attackers to inject arbitrary JavaScript by manipulating unsanitized request parameters like ClientName, BackupName, and grpName. These parameters are reflected in web responses without proper sanitization, enabling execution of malicious scripts in a victim's browser session.

Detection Guidance

Check if your Vembu BDRSuite version is below 7.6.0. Inspect network traffic for requests to templates/progress/serverside/serverbackupprogress.sgp with parameters like ClientName, BackupName, or grpName containing JavaScript code. Look for POST requests to dodeleteclientbackup.sgp with unsanitized input.

Impact Analysis

This vulnerability can lead to session hijacking, where attackers steal user session cookies to gain unauthorized access. It may also allow attackers to manipulate the user interface, perform actions on behalf of the victim, or steal sensitive data. Exploitation can occur via crafted links or requests without requiring authentication.

Mitigation Strategies

Upgrade Vembu BDRSuite to version 7.6.0 or later immediately. If immediate upgrade is not possible, restrict access to the vulnerable endpoints or disable them temporarily. Monitor for suspicious activity in logs related to the affected parameters.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-71451. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...