{"id":"CVE-2025-71451","kind":"vulnerability","aliases":["CVE-2025-71451"],"related":[],"title":"Vembu BDRSuite: unauthenticated cross-site scripting in backup progress page","description":"Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/serverside/serverbackupprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as ClientName, BackupName, and grpName that are interpolated unsanitized into loadXMLDoc() calls and reflected in AbortBackup() POST requests to dodeleteclientbackup.sgp. Attackers can craft malicious links or requests to execute arbitrary JavaScript in a victim's browser session, enabling session hijacking or interface manipulation.","summary":"Vembu BDRSuite before 7.6.0 reflects unsanitized request parameters such as ClientName and BackupName into its backup progress page. An attacker who gets a victim to open a crafted link can run JavaScript in the victim's browser session, enabling session hijacking or interface manipulation.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backup-servers","infrastructure","vembu-bdrsuite","windows"],"not_affected_if":["version-7.6.0-or-later"],"how_to_check":"- Check the installed BDRSuite version in the admin console or install directory, and see whether it is below `7.6.0`.","fix":"- Move BDRSuite to `7.6.0` or later.","status":"open","published_at":"2026-11-03T20:18:05+00:00","first_seen_at":"2026-11-03T20:49:22+00:00","triaged_at":"2026-11-03T20:50:33+00:00","updated_at":"2026-11-03T20:50:33+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-03T20:50:33Z","model":"claude-haiku-5-5","output":{"fix":"- Move BDRSuite to `7.6.0` or later.","reach":"network","title":"Vembu BDRSuite: unauthenticated cross-site scripting in backup progress page","impact":"medium","summary":"Vembu BDRSuite before 7.6.0 reflects unsanitized request parameters such as ClientName and BackupName into its backup progress page. An attacker who gets a victim to open a crafted link can run JavaScript in the victim's browser session, enabling session hijacking or interface manipulation.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["vembu-bdrsuite","backup-servers","windows"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs JavaScript in admin's browser, hijacking sessions","analyst_note":"","how_to_check":"- Check the installed BDRSuite version in the admin console or install directory, and see whether it is below `7.6.0`.\n- unknown for any other check; the sources do not describe a configuration to inspect.","plain_action":"","needs_analyst":false,"not_affected_if":["version-7.6.0-or-later"],"who_is_affected":"Any organization running Vembu BDRSuite before `7.6.0` with its web console reachable by staff. The flaw needs a victim to open a malicious link while logged in, so exposure depends on how the console is accessed. Installations already on `7.6.0` or later are not affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000699,"input_tokens":4265,"output_tokens":545,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2025':13A,16A '-71451':14A,17A '7.6.0':29B,73C 'abortbackup':112C 'allow':85C 'arbitrari':90C,126C 'attack':45B,87C,117C 'backup':9A,19B,41B 'backup-serv':18B 'backupnam':38B,99C 'bdrsuit':2A,24B,27B,71C 'browser':62B,132C 'call':108C 'clientnam':36B,98C 'contain':74C 'craft':53B,119C 'cross':5A,78C 'cross-sit':4A,77C 'cve':12A,15A 'dodeleteclientbackup.sgp':116C 'enabl':64B,134C 'execut':125C 'get':47B 'grpname':101C 'hijack':66B,136C 'infrastructur':21B 'inject':89C 'interfac':68B,138C 'interpol':104C 'javascript':57B,91C,127C 'link':54B,121C 'loadxmldoc':107C 'malici':120C 'manipul':69B,93C,139C 'open':51B 'page':11A,43B 'paramet':33B,95C 'post':113C 'progress':10A,42B 'reflect':30B,110C 'remot':86C 'request':32B,94C,114C,123C 'run':56B 'script':7A,80C 'server':20B 'session':63B,65B,133C,135C 'site':6A,79C 'templates/progress/serverside/serverbackupprogress.sgp':83C 'unauthent':3A,76C 'unsanit':31B,105C 'vembu':1A,23B,26B,70C 'vembu-bdrsuit':22B 'victim':49B,60B,130C 'vulner':81C 'window':25B","nicknames":[],"mitigations":[],"who_affected":"Any organization running Vembu BDRSuite before `7.6.0` with its web console reachable by staff. The flaw needs a victim to open a malicious link while logged in, so exposure depends on how the console is accessed. Installations already on `7.6.0` or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["backupservers","infrastructure","medium","vembubdrsuite","windows"],"campaign_type":null,"first_public_at":"2026-11-03T20:18:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-71451","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71451","severity":null,"published_at":"2026-11-03T20:18:05+00:00","modified_at":"2026-11-03T20:18:05+00:00","first_seen_at":"2026-11-03T20:49:22+00:00","fetched_at":"2026-11-03T20:49:22+00:00","note":null}],"documents":[{"id":60559,"url":"https://www.vulncheck.com/advisories/vembu-bdrsuite-xss-via-serverbackupprogress-sgp","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}