---
id: "CVE-2025-71452"
kind: "vulnerability"
aliases: ["CVE-2025-71452"]
title: "Vembu BDRSuite: unauthenticated XSS via restore progress page parameters"
severity: "medium"
cvss: 6.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["backup", "infrastructure", "self-hosted", "vembu-bdrsuite"]
not_affected_if: ["version-7.6.0-or-later"]
published_at: "2026-11-03T20:18:05+00:00"
first_seen_at: "2026-11-03T20:49:22+00:00"
updated_at: "2026-11-03T20:50:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71452", "first_seen_at": "2026-11-03T20:49:22+00:00"}]
---

# Vembu BDRSuite: unauthenticated XSS via restore progress page parameters

Vembu BDRSuite versions before 7.6.0 reflect several request parameters unsanitized into the restore progress page. An attacker who gets a victim to open a crafted link can run JavaScript in the victim's browser session, enabling session hijacking or interface manipulation.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed BDRSuite version; versions below `7.6.0` are in scope.
- Confirm whether the BDRSuite web console is reachable by users who could be sent a link.

## Fix

- Move BDRSuite to `7.6.0` or later.

## Timeline

- 2026-11-03T20:49:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-71452

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/vembu-bdrsuite-xss-via-restoreprogress-sgp

## From the sources

Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/clientside/restoreprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as mn, rnm, isRepliRestore, rusr, and rpwd that are reflected unsanitized into the HTML response. Attackers can craft malicious links to execute arbitrary JavaScript in a victim's browser session, enabling session hijacking or interface manipulation.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_