CVE-2025-59901

Disk Pulse Enterprise v10.4.18 has an authenticated reflected XSS vulnerability in the '/monitor_directory?sid=' endpoint, caused by insufficient validation of the 'monitor_directory' parameter sent by POST. An attacker could exploit this weakness to send malicious content to an authenticated user and steal information from their session.

Score

CVSS 4.0 8.5 High

Status

Deferred - cve-coordination@incibe.es

Published

2026-01-28

Last modified

2026-01-28

Weaknesses

CWE-352

Affected products

• Disk Pulse Enterprise (Flexense)
• Sync Breeze Enterprise Server (Flexense)

References

• https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-flexense-products