Persistent Authenticated XSS in Sync Breeze and Disk Pulse Products by Flexense

CVE-2025-59896

What is CVE-2025-59896?

Flexense products, including Sync Breeze Enterprise Server and Disk Pulse Enterprise, exhibit a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attacker may exploit this flaw by sending malicious content to an authenticated user, potentially leading to the unauthorized access of session information. This vulnerability arises from inadequate validation of user input in the 'command_name' parameter within the '/add_command?sid=' endpoint. Awareness and prompt action to mitigate this issue are crucial for maintaining security.

References