CVE-2025-71452
Last modified
CVE-2025-71452 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/clientside/restoreprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as mn, rnm, isRepliRestore, rusr, and rpwd that are reflected unsanitized into the HTML response. Attackers can craft malicious links to execute arbitrary JavaScript in a victim's browser session, enabling session hijacking or interface manipulation..
Description
Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/clientside/restoreprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as mn, rnm, isRepliRestore, rusr, and rpwd that are reflected unsanitized into the HTML response. Attackers can craft malicious links to execute arbitrary JavaScript in a victim's browser session, enabling session hijacking or interface manipulation.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Vembu Technologies | BDRSuite | < 7.6.0 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2025-71452?
How severe is CVE-2025-71452?
How do I fix CVE-2025-71452?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-71438An out-of-bounds read in gf_odf_ac4_cfg_dsi_v1 (/odf/descrip…5.5
- CVE-2025-71439llama.cpp before b5649 contains a heap out-of-bounds read vu…5.5
- CVE-2025-7144A vulnerability has been found in SourceCodester Best Salon …4.8
- CVE-2025-7145ThreatSonar Anti-Ransomware developed by TeamT5 has an OS Co…8.6
- CVE-2025-71450inih before r63 contains a one-byte stack buffer under-read …3.3
- CVE-2025-71451Vembu BDRSuite before 7.6.0 contains an unauthenticated cros…6.1
- CVE-2025-71453vtenext before 25.02.2 contains a reflected cross-site scrip…6.1
- CVE-2025-71454vtenext before 25.02.2 contains a cross-site request forgery…6.5
- CVE-2025-71455vtenext before 25.02.2 contains a session identifier disclos…5.3
- CVE-2025-71456vtenext before 25.02.2 contains an SQL injection vulnerabili…8.1
- CVE-2025-71457vtenext 25.02 before 25.02.1 contains an authentication bypa…9.8
- CVE-2025-71458FTS3 Web Monitoring (fts-monitoring) versions 3.12.0 through…7.5
Are you affected by CVE-2025-71452?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST