Persistent Authenticated Cross-Site Scripting in Flexense Products
CVE-2025-59898

5.1MEDIUM

Key Information:

Vendor

FleXen Projectse

Status
Sync Breeze Enterprise Server
Disk Pulse Enterprise
Vendor
CVE Published:
28 January 2026

What is CVE-2025-59898?

A persistent authenticated Cross-Site Scripting (XSS) flaw has been identified in specific versions of Flexense products. This vulnerability arises from inadequate validation of user input in the 'exclude_dir' parameter while accessing the '/add_exclude_dir?sid=' endpoint. Attackers can exploit this weakness by delivering malicious content to authenticated users, potentially leading to unauthorized access to sensitive session information.

Affected Version(s)

Disk Pulse Enterprise v10.4.18

Sync Breeze Enterprise Server v10.4.18

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multip...

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafael Pedrero
.