---
id: CVE-2025-71452
title: Vembu BDRSuite < 7.6.0 XSS via restoreprogress.sgp
summary: >-
  Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting
  vulnerability in templates/progress/clientside/restoreprogress.sgp that allows
  remote attackers to inject arbitrary JavaScript by manipulating request
  parameter…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: Vembu Technologies
product: BDRSuite
affected:
  - BDRSuite < 7.6.0
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T19:48:58.651Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-71452'
references:
  - url: 'https://chocapikk.com/posts/2025/bdrsuite/'
    label: Chocapikk Blog
  - url: 'https://support.bdrshield.com/portal/en/kb/articles/release-notes'
    label: Release Notes
  - url: >-
      https://www.vulncheck.com/advisories/vembu-bdrsuite-xss-via-restoreprogress-sgp
    label: 'VulnCheck Advisory: Vembu BDRSuite < 7.6.0 XSS via restoreprogress.sgp'
tags:
  - cve.org
epss: 0.0029
epssPercentile: 0.21701
ingestedAt: '2026-11-05T20:33:06.404Z'
---

## Overview

Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/clientside/restoreprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as mn, rnm, isRepliRestore, rusr, and rpwd that are reflected unsanitized into the HTML response. Attackers can craft malicious links to execute arbitrary JavaScript in a victim's browser session, enabling session hijacking or interface manipulation.

## Affected

- `BDRSuite < 7.6.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.