CVE-2025-71451

Name of the Vulnerable Software and Affected Versions Vembu BDRSuite versions prior to 7.6.0

Description An unauthenticated cross-site scripting issue exists in the templates/progress/serverside/serverbackupprogress.sgp file. Remote attackers can inject arbitrary JavaScript by manipulating the ClientName, BackupName, and grpName parameters. These variables are interpolated without sanitization into loadXMLDoc() calls and reflected in AbortBackup() POST requests sent to the dodeleteclientbackup.sgp endpoint. This allows for the execution of malicious scripts in a victim's browser session, potentially leading to session hijacking or interface manipulation.

Recommendations Update Vembu BDRSuite to version 7.6.0 or later.