What is GHSA-8cj8-qq8j-g68q?

GHSA-8cj8-qq8j-g68q is a security advisory published by GitHub Security Advisories with Medium severity. Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in...

Which CVE IDs does GHSA-8cj8-qq8j-g68q cover?

GHSA-8cj8-qq8j-g68q covers the following CVE IDs: CVE-2025-71451. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-8cj8-qq8j-g68q?

GHSA-8cj8-qq8j-g68q has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

GHSA-8cj8-qq8j-g68qMediumCVSS 6.1

Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in...

Vendor

GitHub Security Advisories

Published

November 3, 2026

Last Modified

November 3, 2026

🔗 CVE IDs covered (1)

CVE-2025-71451 →

📋 Description

Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/serverside/serverbackupprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as ClientName, BackupName, and grpName that are interpolated unsanitized into loadXMLDoc() calls and reflected in AbortBackup() POST requests to dodeleteclientbackup.sgp. Attackers can craft malicious links or requests to execute arbitrary JavaScript in a victim's browser session, enabling session hijacking or interface manipulation.

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2025-71451
https://chocapikk.com/posts/2025/bdrsuite
https://support.bdrshield.com/portal/en/kb/articles/release-notes
https://www.vulncheck.com/advisories/vembu-bdrsuite-xss-via-serverbackupprogress-sgp
https://github.com/advisories/GHSA-8cj8-qq8j-g68q