Vembu BDRSuite < 7.6.0 XSS via restoreprogress.sgp

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/clientside/restoreprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as mn, rnm, isRepliRestore, rusr, and rpwd that are reflected unsanitized into the HTML response. Attackers can craft malicious links to execute arbitrary JavaScript in a victim's browser session, enabling session hijacking or interface manipulation.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• support.bdrshield.com/portal/en/kb/articles/release-notes Yama
• vulncheck.com/…ies/vembu-bdrsuite-xss-via-restoreprogress-sgp Üçüncü taraf
• chocapikk.com/posts/2025/bdrsuite İstismar kodu ya da analiz

Kayıt geçmişi

1. 3 Kas 2026 22:48Yayımlandı

İlgili açıklar

• 6,1 CVE-2025-71451Vembu BDRSuite < 7.6.0 XSS via serverbackupprogress.sgp
• 2,4 CVE-2026-122190SourceCodester Online Food Ordering System Category Management add_category.php cross site scripting
• 5,4 CVE-2026-54380VitaFit Cloud API Stored XSS via SVG File Upload
• 4,7 CVE-2026-122234jsondiffpatch before 0.7.7 XSS via Array-Move Destination in HTML Formatters
• 6,1 CVE-2025-71453vtenext before 25.02.2 Reflected XSS via widgetInfoList in HomeWidgetBlockList
• 6,3 CVE-2026-113369Nexus Repository 3 - Stored Cross-Site Scripting in OCI Attestations Tab