{"id":"CVE-2025-71452","kind":"vulnerability","aliases":["CVE-2025-71452"],"related":[],"title":"Vembu BDRSuite: unauthenticated XSS via restore progress page parameters","description":"Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/clientside/restoreprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as mn, rnm, isRepliRestore, rusr, and rpwd that are reflected unsanitized into the HTML response. Attackers can craft malicious links to execute arbitrary JavaScript in a victim's browser session, enabling session hijacking or interface manipulation.","summary":"Vembu BDRSuite versions before 7.6.0 reflect several request parameters unsanitized into the restore progress page. An attacker who gets a victim to open a crafted link can run JavaScript in the victim's browser session, enabling session hijacking or interface manipulation.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backup","infrastructure","self-hosted","vembu-bdrsuite"],"not_affected_if":["version-7.6.0-or-later"],"how_to_check":"- Check the installed BDRSuite version; versions below `7.6.0` are in scope.\n- Confirm whether the BDRSuite web console is reachable by users who could be sent a link.","fix":"- Move BDRSuite to `7.6.0` or later.","status":"open","published_at":"2026-11-03T20:18:05+00:00","first_seen_at":"2026-11-03T20:49:22+00:00","triaged_at":"2026-11-03T20:50:33+00:00","updated_at":"2026-11-03T20:50:33+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-03T20:50:33Z","model":"claude-haiku-5-5","output":{"fix":"- Move BDRSuite to `7.6.0` or later.","reach":"internet","title":"Vembu BDRSuite: unauthenticated XSS via restore progress page parameters","impact":"medium","summary":"Vembu BDRSuite versions before 7.6.0 reflect several request parameters unsanitized into the restore progress page. An attacker who gets a victim to open a crafted link can run JavaScript in the victim's browser session, enabling session hijacking or interface manipulation.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["vembu-bdrsuite","backup","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs JavaScript in a victim's browser session, hijacking sessions.","analyst_note":"","how_to_check":"- Check the installed BDRSuite version; versions below `7.6.0` are in scope.\n- Confirm whether the BDRSuite web console is reachable by users who could be sent a link.","plain_action":"","needs_analyst":false,"not_affected_if":["version-7.6.0-or-later"],"who_is_affected":"Organisations running Vembu BDRSuite before 7.6.0 with a web console that staff open in a browser. Exposure depends on whether the console is reachable from networks where a user could be lured into clicking a crafted link; the sources do not describe any other preconditions.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000689,"input_tokens":4232,"output_tokens":532,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2025':11A,14A '-71452':12A,15A '7.6.0':28B,68C 'allow':80C 'arbitrari':85C,114C 'attack':40B,82C,107C 'backup':16B 'bdrsuit':2A,23B,25B,66C 'browser':57B,120C 'contain':69C 'craft':48B,109C 'cross':73C 'cross-sit':72C 'cve':10A,13A 'enabl':59B,122C 'execut':113C 'get':42B 'hijack':61B,124C 'host':20B 'html':105C 'infrastructur':17B 'inject':84C 'interfac':63B,126C 'isreplirestor':95C 'javascript':52B,86C,115C 'link':49B,111C 'malici':110C 'manipul':64B,88C,127C 'mn':93C 'open':46B 'page':8A,38B 'paramet':9A,32B,90C 'progress':7A,37B 'reflect':29B,101C 'remot':81C 'request':31B,89C 'respons':106C 'restor':6A,36B 'rnm':94C 'rpwd':98C 'run':51B 'rusr':96C 'script':75C 'self':19B 'self-host':18B 'session':58B,60B,121C,123C 'sever':30B 'site':74C 'templates/progress/clientside/restoreprogress.sgp':78C 'unauthent':3A,71C 'unsanit':33B,102C 'vembu':1A,22B,24B,65C 'vembu-bdrsuit':21B 'version':26B 'via':5A 'victim':44B,55B,118C 'vulner':76C 'xss':4A","nicknames":[],"mitigations":[],"who_affected":"Organisations running Vembu BDRSuite before 7.6.0 with a web console that staff open in a browser. Exposure depends on whether the console is reachable from networks where a user could be lured into clicking a crafted link; the sources do not describe any other preconditions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["backup","infrastructure","medium","selfhosted","vembubdrsuite"],"campaign_type":null,"first_public_at":"2026-11-03T20:18:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-71452","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71452","severity":null,"published_at":"2026-11-03T20:18:05+00:00","modified_at":"2026-11-03T20:18:05+00:00","first_seen_at":"2026-11-03T20:49:22+00:00","fetched_at":"2026-11-03T20:49:22+00:00","note":null}],"documents":[{"id":60560,"url":"https://www.vulncheck.com/advisories/vembu-bdrsuite-xss-via-restoreprogress-sgp","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}