Cross-Site Scripting Flaw in Vembu BDRSuite Affects Remote Server Backup Operations
CVE-2025-71451

5.1MEDIUM

Key Information:

Vendor

Vembu Technologies

Status
Bdrsuite
Vendor
CVE Published:
3 November 2026

Badges

👾 Exploit Exists

What is CVE-2025-71451?

Vembu BDRSuite prior to version 7.6.0 is susceptible to an unauthenticated Cross-Site Scripting vulnerability. Attackers can exploit this flaw by manipulating URL parameters such as ClientName, BackupName, and grpName, leading to unsanitized input being interpolated into JavaScript function calls. This allows the execution of arbitrary JavaScript within the context of the user's browser session, which can result in session hijacking or unauthorized manipulation of the application interface. Users are advised to upgrade to the latest version to mitigate this risk.

Affected Version(s)

BDRSuite 0 < 7.6.0

References

https://chocapikk.com/posts/2025/bdrsuite/
technical-descriptionexploit
https://support.bdrshield.com/portal/en/kb/articles/relea...
release-notespatch
https://www.vulncheck.com/advisories/vembu-bdrsuite-xss-v...
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Valentin Lobstein (Chocapikk)
.