---
id: CVE-2025-71451
title: Vembu BDRSuite < 7.6.0 XSS via serverbackupprogress.sgp
summary: >-
  Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting
  vulnerability in templates/progress/serverside/serverbackupprogress.sgp that
  allows remote attackers to inject arbitrary JavaScript by manipulating request
  para…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: Vembu Technologies
product: BDRSuite
affected:
  - BDRSuite < 7.6.0
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-07T03:28:15.713821Z'
exploitAvailable: true
published: '2026-11-03'
updated: '2026-11-07'
sourceUpdated: '2026-11-07T03:28:24.774Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-71451'
references:
  - url: 'https://chocapikk.com/posts/2025/bdrsuite/'
    label: Chocapikk Blog
  - url: 'https://support.bdrshield.com/portal/en/kb/articles/release-notes'
    label: Release Notes
  - url: >-
      https://www.vulncheck.com/advisories/vembu-bdrsuite-xss-via-serverbackupprogress-sgp
    label: >-
      VulnCheck Advisory: Vembu BDRSuite < 7.6.0 XSS via
      serverbackupprogress.sgp
tags:
  - cve.org
  - exploit-available
epss: 0.0029
epssPercentile: 0.21701
ingestedAt: '2026-11-05T20:33:06.404Z'
---

## Overview

Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/serverside/serverbackupprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as ClientName, BackupName, and grpName that are interpolated unsanitized into loadXMLDoc() calls and reflected in AbortBackup() POST requests to dodeleteclientbackup.sgp. Attackers can craft malicious links or requests to execute arbitrary JavaScript in a victim's browser session, enabling session hijacking or interface manipulation.

## Affected

- `BDRSuite < 7.6.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.