Description
Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attacker could send malicious content to an authenticated user and steal information from their session due to insufficient validation of user input in '/add_exclude_dir?sid=', affecting the 'exclude_dir' parameter.
Published: 2026-01-28
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Feb 2026 21:15:00 +0000

Type Values Removed Values Added
First Time appeared Flexense diskpulse
Flexense syncbreeze
CPEs cpe:2.3:a:flexense:diskpulse:10.4.18:*:*:*:enterprise:*:*:*
cpe:2.3:a:flexense:syncbreeze:10.4.18:*:*:*:enterprise:*:*:*
Vendors & Products Flexense diskpulse
Flexense syncbreeze
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

Wed, 28 Jan 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 28 Jan 2026 12:15:00 +0000

Type Values Removed Values Added
Description Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attacker could send malicious content to an authenticated user and steal information from their session due to insufficient validation of user input in '/add_exclude_dir?sid=', affecting the 'exclude_dir' parameter.
Title Authenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise Server
First Time appeared Flexense
Flexense disk Pulse Enterprise
Flexense sync Breeze Enterprise Server
Weaknesses CWE-79
CPEs cpe:2.3:a:flexense:disk_pulse_enterprise:v10.4.18:*:*:*:*:*:*:*
cpe:2.3:a:flexense:sync_breeze_enterprise_server:v10.4.18:*:*:*:*:*:*:*
Vendors & Products Flexense
Flexense disk Pulse Enterprise
Flexense sync Breeze Enterprise Server
References
Metrics cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}

Subscriptions

Flexense Disk Pulse Enterprise Diskpulse Sync Breeze Enterprise Server Syncbreeze
cve-icon MITRE

Status: PUBLISHED

Assigner: INCIBE

Published:

Updated: 2026-01-28T15:32:32.025Z

Reserved: 2025-09-23T10:22:34.913Z

Link: CVE-2025-59898

cve-icon Vulnrichment

Updated: 2026-01-28T15:32:11.365Z

cve-icon NVD

Status : Analyzed

Published: 2026-01-28T12:15:51.490

Modified: 2026-02-10T21:04:21.873

Link: CVE-2025-59898

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses