CVE-2025-71452: Vembu BDRSuite < 7.6.0 XSS via restoreprogress.sgp

Q: Who is exposed to exploitation?

Users of Vembu BDRSuite versions before 7.6.0 are exposed when they can be induced to open a malicious link targeting the vulnerable restore-progress endpoint. The attacker does not need authentication, but JavaScript execution occurs in the victim's browser session.

Q: What does an attacker need to exploit this issue?

An attacker needs to craft a malicious request or link containing manipulated parameters such as mn, rnm, isRepliRestore, rusr, or rpwd, and convince a victim to load it. No attacker privileges are required.

Q: What can be done if upgrading is not immediately possible?

The provided information does not specify a workaround. Until the affected installation is updated to 7.6.0 or later, limit user exposure to untrusted links and monitor for suspicious requests to templates/progress/clientside/restoreprogress.sgp with attacker-controlled parameter values.

Published Nov 3, 2026

Updated

Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/clientside/restoreprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as mn, rnm, isRepliRestore, rusr, and rpwd that are reflected unsanitized into the HTML response. Attackers can craft malicious links to execute arbitrary JavaScript in a victim's browser session, enabling session hijacking or interface manipulation.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Vembu BDRSuite to a version that resolves this vulnerability.
Fixed in 7.6.0

Event History

Nov 3, 2026

CVE Published

via MITRE·07:48 PM

Data Sourced

via MITRE·07:48 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to exploitation?

Users of Vembu BDRSuite versions before 7.6.0 are exposed when they can be induced to open a malicious link targeting the vulnerable restore-progress endpoint. The attacker does not need authentication, but JavaScript execution occurs in the victim's browser session.

What does an attacker need to exploit this issue?

An attacker needs to craft a malicious request or link containing manipulated parameters such as mn, rnm, isRepliRestore, rusr, or rpwd, and convince a victim to load it. No attacker privileges are required.

What can be done if upgrading is not immediately possible?

The provided information does not specify a workaround. Until the affected installation is updated to 7.6.0 or later, limit user exposure to untrusted links and monitor for suspicious requests to templates/progress/clientside/restoreprogress.sgp with attacker-controlled parameter values.

CVE-2025-71452: Vembu BDRSuite < 7.6.0 XSS via restoreprogress.sgp

Remediation

Event History

Frequently Asked Questions

Who is exposed to exploitation?

What does an attacker need to exploit this issue?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to exploitation?

What does an attacker need to exploit this issue?

What can be done if upgrading is not immediately possible?