Live › vulnerability › CVE-2025-71451
Vembu BDRSuite before 7.6.0 reflects unsanitized request parameters such as ClientName and BackupName into its backup progress page. An attacker who gets a victim to open a crafted link can run JavaScript in the victim's browser session, enabling session hijacking or interface manipulation.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 20:49 UTC. All times on this page are UTC.
Any organization running Vembu BDRSuite before 7.6.0 with its web console reachable by staff. The flaw needs a victim to open a malicious link while logged in, so exposure depends on how the console is accessed. Installations already on 7.6.0 or later are not affected.
No product ranges from the sources yet.
7.6.0.7.6.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/serverside/serverbackupprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as ClientName, BackupName, and grpName that are interpolated unsanitized into loadXMLDoc() calls and reflected in AbortBackup() POST requests to dodeleteclientbackup.sgp. Attackers can craft malicious links or requests to execute arbitrary JavaScript in a victim's browser session, enabling session hijacking or interface manipulation.
This page as .md · .json · in your agent: get_signal("CVE-2025-71451")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.