Authenticated Reflected XSS Vulnerability in Disk Pulse Enterprise by Flexense
CVE-2025-59901

8.5HIGH

Key Information:

Vendor

FleXen Projectse

Status
Sync Breeze Enterprise Server
Disk Pulse Enterprise
Vendor
CVE Published:
28 January 2026

What is CVE-2025-59901?

Disk Pulse Enterprise version 10.4.18 contains an authenticated reflected XSS vulnerability within the '/monitor_directory?sid=' endpoint. The issue arises from inadequate validation of the 'monitor_directory' parameter transmitted via POST requests. An attacker can exploit this vulnerability to inject malicious scripts, targeting authenticated users and potentially compromising their session information.

Affected Version(s)

Disk Pulse Enterprise v10.4.18

Sync Breeze Enterprise Server v10.4.18

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multip...

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafael Pedrero
.