CVE-2026-88743

18th percentile - higher than 18% of all known CVEs

Bacularis 4.7.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in director tags. The vulnerability allows injection of malicious code that is stored and executed in other users' browsers.

An attacker can execute arbitrary JavaScript in the victim's session context, potentially leading to credential theft, account takeover, or other actions on behalf of the user. In a backup management environment, this could result in full system compromise.

Update Bacularis to a version later than 6.5.0 if available. Until patched, restrict access to the Bacularis interface and audit for unauthorized changes.