CVE-2026-88742

15th percentile - higher than 15% of all known CVEs

Bacularis 1.0.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in the client address field. The vulnerability allows injection of malicious code that is stored and executed in other users' browsers.

An attacker can execute arbitrary JavaScript in the victim's session context, potentially leading to credential theft, account takeover, or other actions on behalf of the user. In a backup management environment, this could result in full system compromise.

Update Bacularis to a version later than 6.5.0 if available. Until patched, restrict access to the Bacularis interface and audit for unauthorized changes.