Persistent Authenticated XSS in Sync Breeze and Disk Pulse Products by Flexense

CVE-2025-59896

What is CVE-2025-59896?

Flexense products, including Sync Breeze Enterprise Server and Disk Pulse Enterprise, exhibit a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attacker may exploit this flaw by sending malicious content to an authenticated user, potentially leading to the unauthorized access of session information. This vulnerability arises from inadequate validation of user input in the 'command_name' parameter within the '/add_command?sid=' endpoint. Awareness and prompt action to mitigate this issue are crucial for maintaining security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References