Vembu BDRSuite versions prior to 7.6.0 contain an unauthenticated cross‑site scripting flaw in the serverbackupprogress.sgp template. The vulnerability arises because request parameters such as ClientName, BackupName, and grpName are unsanitized when interpolated into JavaScript loadXMLDoc() calls, reflecting in the AbortBackup() POST endpoint. Attackers can supply crafted values, enabling arbitrary JavaScript execution in the victim’s browser session and potentially leading to session hijacking or interface manipulation.

Vembu Technologies’ BDRSuite application, specifically versions below 7.6.0, is affected. The issue exists in the templates/progress/serverside/serverbackupprogress.sgp file and can be triggered in any environment where BDRSuite is deployed, regardless of network segmentation, because the flaw is unauthenticated.

The CVSS score of 5.1 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. As the flaw is unauthenticated and relies on browser execution, an attacker only needs to lure a user to visit a malicious link or submit a crafted request; thus the attack vector is predominantly a client‑side exploitation via social engineering or malicious content. The impact is limited to the victim’s browser session, but success can lead to session hijacking or manipulation of the BDRSuite interface.