CVE-2025-59901 - CVE House
Back to Database
Status published High CVE-2025-59901

authenticated reflected XSS vulnerability in Sync Breeze Enterprise Server

Vulnerability Description

Disk Pulse Enterprise v10.4.18 has an authenticated reflected XSS vulnerability in the '/monitor_directory?sid=' endpoint, caused by insufficient validation of the 'monitor_directory' parameter sent by POST. An attacker could exploit this weakness to send malicious content to an authenticated user and steal information from their session.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-59901

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Rafael Pedrero

References

More from Flexense

View All →
CVE-2025-59900
Authenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise Server
Medium 5.1
CVE-2025-59899
Authenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise Server
Medium 5.1
CVE-2025-59898
Authenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise Server
Medium 5.1
CVE-2025-59897
Authenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise Server
Medium 5.1
CVE-2025-59896
Authenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise Server
Medium 5.1

Affected Vendor

Affected Software

Sync Breeze Enterprise Server, Disk Pulse Enterprise
Vulnerable Versions:
v10.4.18

Timeline

Official Publish: January 28th, 2026
Last Modified: January 28th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-352

MITRE ATT&CK TTPs

T1566.002 Spearphishing Link
Initial Access
T1204.001 Malicious Link
Execution
T1098 Account Manipulation
Persistence
T1565.001 Stored Data Manipulation
Impact