CVE-2025-59901 — authenticated reflected XSS vulnerability in Sync Breeze Enterprise Server
Disk Pulse Enterprise v10.4.18 has an authenticated reflected XSS vulnerability in the '/monitor_directory?sid=' endpoint, caused by insufficient validation of the 'monitor_dire…
Published: 2026-01-28 · CVSS: 8.5 · CVSS 4.0
Disk Pulse Enterprise v10.4.18 has an authenticated reflected XSS vulnerability in the '/monitor_directory?sid=' endpoint, caused by insufficient validation of the 'monitor_directory' parameter sent by POST. An attacker could exploit this weakness to send malicious content to an authenticated user and steal information from their session.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7