Read the docs
TI-2025-44006 Aliases CVE-2025-71451GHSA-8cj8-qq8j-g68q

Cross-site scripting in Vembu BDRSuite via serverbackupprogress.sgp

Priority MEDIUM 56CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Vembu BDRSuite before 7.6.0 contains a cross-site scripting flaw in the serverbackupprogress.sgp template (CWE-79). The template reflects request parameters such as ClientName and BackupName into page scripts without sanitizing them. An unauthenticated remote attacker can use crafted links to run JavaScript in a victim's browser session, which enables session hijacking or manipulation of the interface. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/serverside/serverbackupprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as ClientName, BackupName, and grpName that are interpolated unsanitized into loadXMLDoc() calls and reflected in AbortBackup() POST requests to dodeleteclientbackup.sgp. Attackers can craft malicious links or requests to execute arbitrary JavaScript in a victim's browser session, enabling session hijacking or interface manipulation.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0029 21st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed BDRSuite (Vembu Technologies): 7.6.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Vembu TechnologiesBDRSuitebefore 7.6.07.6.0Patch availableCNA
  • BDRSuite VendorVembu Technologies Affected before 7.6.0 Fixed in 7.6.0 Patch available CNA

Remediation

Upgrade Vembu BDRSuite to 7.6.0, the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

  • Fix · CNA BDRSuite (Vembu Technologies) Fixed in 7.6.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Vembu Technologies BDRSuite 7.6.0

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2025-44007 Cross-site scripting in Vembu BDRSuite restore progress pagePriority LOW 23
    Show all 2 records →

Timeline

  1. 2026-11-03 Threatist record created from CVE-2025-71451
  2. 2026-11-03 Alias added: GHSA-8cj8-qq8j-g68q
  3. 2026-11-07 CISA SSVC decision points changed
  4. 2026-11-07 Priority changed: LOW → MEDIUM

References

Exploit 1

Patch 1

  • TI-2025-44007 Cross-site scripting in Vembu BDRSuite restore progress page CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences