Read the docs
TI-2025-44007 Aliases CVE-2025-71452GHSA-vrjh-j947-6q7h

Cross-site scripting in Vembu BDRSuite restore progress page

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Vembu BDRSuite before 7.6.0 contains a cross-site scripting flaw (CWE-79) in templates/progress/clientside/restoreprogress.sgp. Request parameters such as mn, rnm, isRepliRestore, rusr and rpwd are reflected into the HTML response without sanitization. An unauthenticated remote attacker can craft a malicious link that runs arbitrary JavaScript in a victim's browser session, enabling session hijacking or interface manipulation. The references include a link to an exploit.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/clientside/restoreprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as mn, rnm, isRepliRestore, rusr, and rpwd that are reflected unsanitized into the HTML response. Attackers can craft malicious links to execute arbitrary JavaScript in a victim's browser session, enabling session hijacking or interface manipulation.

Why it matters now

EPSS 0.0029 21st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed BDRSuite (Vembu Technologies): 7.6.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Vembu TechnologiesBDRSuitebefore 7.6.07.6.0Patch availableCNA
  • BDRSuite VendorVembu Technologies Affected before 7.6.0 Fixed in 7.6.0 Patch available CNA

Remediation

Upgrade Vembu BDRSuite to version 7.6.0 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA BDRSuite (Vembu Technologies) Fixed in 7.6.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Vembu Technologies BDRSuite 7.6.0

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2025-44006 Cross-site scripting in Vembu BDRSuite via serverbackupprogress.sgpPriority MEDIUM 56
    Show all 2 records →

Timeline

  1. 2026-11-03 Threatist record created from CVE-2025-71452
  2. 2026-11-03 Alias added: GHSA-vrjh-j947-6q7h

References

Exploit 1

Patch 1

  • TI-2025-44006 Cross-site scripting in Vembu BDRSuite via serverbackupprogress.sgp CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences