CVE-2025-59899
Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attacker could send malicious content to an authenticated user and steal information from their session due to insufficient validation of user input in '/server_options?sid=', affecting the 'tasks_logs_dir', 'errors_logs_dir', 'error_notifications_address', 'status_notifications_address', and 'status_reports_address' parameters.
- Score
- CVSS 3.1 5.4 Medium
- Status
- Analyzed - cve-coordination@incibe.es
- Published
- 2026-01-28
- Last modified
- 2026-01-28
- Weaknesses
- CWE-79
Affected products
- Disk Pulse Enterprise (Flexense)
- Diskpulse (Flexense)
- Sync Breeze Enterprise Server (Flexense)
- Syncbreeze (Flexense)
References
- https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-flexense-products
