CVE-2025-59899: medium-severity vulnerability in Flexense Sync Breeze Enterprise Server
Authenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise Server
Published
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.1epss 0.2%
exploitation probability
0.2%top 91% of all CVEs
observed exploitation
nono source reports it
Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attacker could send malicious content to an authenticated user and steal information from their session due to insufficient validation of user input in '/server_options?sid=', affecting the 'tasks_logs_dir', 'errors_logs_dir', 'error_notifications_address', 'status_notifications_address', and 'status_reports_address' parameters.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Related CVEs — Flexense Sync Breeze Enterprise Server
In the same product, most dangerous first.
CVE-2025-59895HIGHRemote denial-of-service (DoS) vulnerability in Sync Breeze Enterprise ServerEPSS 0.4%CVE-2023-49575HIGHXSS vulnerability in VX Search EnterpriseEPSS 0.3%CVE-2023-49572HIGHXSS vulnerability in VX Search EnterpriseEPSS 0.3%CVE-2025-59900MEDIUMAuthenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise ServerEPSS 0.2%CVE-2025-59898MEDIUMAuthenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise ServerEPSS 0.2%CVE-2025-59897MEDIUMAuthenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise ServerEPSS 0.2%