CVE-2025-71452— Vembu BDRSuite < 7.6.0 XSS via restoreprogress.sgp

Quick assessment

Affected

Vembu Technologies BDRSuite

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Vembu BDRSuite 7.6.0 之前的版本在文件中存在一个无需认证即可触发的跨站脚本（XSS）漏洞。该漏洞允许远程攻击者通过操纵请求参数（如、、、和），将未经过滤的内容反射到 HTML 响应中，从而注入任意 JavaScript 代码。攻击者可构造恶意链接，在受害者的浏览器会话中执行任意 JavaScript，进而实现会话劫持或界面篡改。

CVSS 6.1 · Medium Updated Nov 04, 2026

Possible ATT&CK Techniques 2 AI

T1055 · Process Injection T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Vembu BDRSuite < 7.6.0 XSS via restoreprogress.sgp

Source: CVE Program / CVE List V5

Vulnerability Description

Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/clientside/restoreprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as mn, rnm, isRepliRestore, rusr, and rpwd that are reflected unsanitized into the HTML response. Attackers can craft malicious links to execute arbitrary JavaScript in a victim's browser session, enabling session hijacking or interface manipulation.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Vembu Technologies	BDRSuite	0 ~ 7.6.0	-

II. Public POCs for CVE-2025-71452

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2025-71452

请登录查看更多情报信息。

Other References for CVE-2025-71452 (3)

https://support.bdrshield.com/portal/en/kb/articles/release-notes release-notes patch
https://chocapikk.com/posts/2025/bdrsuite/ technical-description exploit
https://www.vulncheck.com/advisories/vembu-bdrsuite-xss-via-restoreprogress-sgp third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2025-71452

IV. Related Vulnerabilities

Same product: BDRSuite

CVE-2025-71451
Vembu BDRSuite < 7.6.0 XSS via serverbackupprogress.sgp

Same vendor: Vembu Technologies

CVE-2025-71451
Vembu BDRSuite < 7.6.0 XSS via serverbackupprogress.sgp

Same weakness: CWE-79