Persistent Authenticated Cross-Site Scripting in Flexense Products

CVE-2025-59899

What is CVE-2025-59899?

The affected versions of Sync Breeze Enterprise Server and Disk Pulse Enterprise are vulnerable to a persistent authenticated Cross-Site Scripting (XSS) attack. This vulnerability allows an attacker to send crafted malicious scripts to authenticated users. Due to inadequate validation of user input in specific parameters, an attacker can exploit this flaw to steal sensitive information from the user's session, compromising the integrity and confidentiality of user data.

References