Unrated severityNVD Advisory· Published Jan 28, 2026· Updated Jan 28, 2026

Authenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise Server

CVE-2025-59898

Description

Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attacker could send malicious content to an authenticated user and steal information from their session due to insufficient validation of user input in '/add_exclude_dir?sid=', affecting the 'exclude_dir' parameter.

Affected products

Syncbreeze/Sync Breeze Enterprisellm-fuzzy
Range: =10.4.18
Flexense/Disk Pulse Enterprisellm-fuzzy
Range: =10.4.18
Flexense/Disk Pulse Enterprisev5
Range: v10.4.18
Flexense/Sync Breeze Enterprise Serverv5
Range: v10.4.18

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-flexense-productsmitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000