Live › vulnerability › CVE-2025-71452
Vembu BDRSuite versions before 7.6.0 reflect several request parameters unsanitized into the restore progress page. An attacker who gets a victim to open a crafted link can run JavaScript in the victim's browser session, enabling session hijacking or interface manipulation.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 20:49 UTC. All times on this page are UTC.
Organisations running Vembu BDRSuite before 7.6.0 with a web console that staff open in a browser. Exposure depends on whether the console is reachable from networks where a user could be lured into clicking a crafted link; the sources do not describe any other preconditions.
No product ranges from the sources yet.
7.6.0 are in scope.7.6.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/clientside/restoreprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as mn, rnm, isRepliRestore, rusr, and rpwd that are reflected unsanitized into the HTML response. Attackers can craft malicious links to execute arbitrary JavaScript in a victim's browser session, enabling session hijacking or interface manipulation.
This page as .md · .json · in your agent: get_signal("CVE-2025-71452")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.