High severity · published Jan 28, 2026
CVE-2025-59901
authenticated reflected XSS vulnerability in Sync Breeze Enterprise Server
8.5
CVSS
0.2%
EPSS
No
On KEV
Description
Disk Pulse Enterprise v10.4.18 has an authenticated reflected XSS vulnerability in the '/monitor_directory?sid=' endpoint, caused by insufficient validation of the 'monitor_directory' parameter sent by POST. An attacker could exploit this weakness to send malicious content to an authenticated user and steal information from their session.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DP
Disk Pulse Enterprise · Flexense
v10.4.18 · source: vendor
SB
Sync Breeze Enterprise Server · Flexense
v10.4.18 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-59901
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-59901
www.incibe.es
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-flexense-products
More from Disk Pulse Enterprise
8.0
CVE-2025-59894
Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server
8.0
CVE-2025-59893
Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server
8.0
CVE-2025-59892
Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server
8.0
CVE-2025-59891
Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server
7.5
CVE-2025-59895
Remote denial-of-service (DoS) vulnerability in Sync Breeze Enterprise Server