Backup Enterprise Manager
Monthly
Cross-site scripting in Veeam Backup Enterprise Manager lets an attacker run arbitrary script in the browser of a portal user who opens a crafted link, potentially exposing session data or allowing actions in the victim's authenticated context. Exploitation is not autonomous: the attacker must already be able to reach the portal with a valid low-privileged account (CVSS PR:L) and must then persuade a logged-in portal user to open the crafted link (UI:A), which is why this is rated a genuinely moderate, not high-priority, issue at 4.8. No public exploit code has been observed and the vulnerability is not in CISA KEV; no EPSS score was supplied with the source data, so likelihood should be treated as bounded by the social-engineering and authentication prerequisites rather than as an opportunistic mass-exploitation risk.
Cross-site scripting in Veeam Backup Enterprise Manager lets an attacker run arbitrary script in the browser of a portal user who opens a crafted link, potentially exposing session data or allowing actions in the victim's authenticated context. Exploitation is not autonomous: the attacker must already be able to reach the portal with a valid low-privileged account (CVSS PR:L) and must then persuade a logged-in portal user to open the crafted link (UI:A), which is why this is rated a genuinely moderate, not high-priority, issue at 4.8. No public exploit code has been observed and the vulnerability is not in CISA KEV; no EPSS score was supplied with the source data, so likelihood should be treated as bounded by the social-engineering and authentication prerequisites rather than as an opportunistic mass-exploitation risk.