CVE-2025-59891: falha de alta gravidade em Flexense Sync Breeze Enterprise Server
Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server
Publicada em
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.5epss 0.1%
probabilidade de exploração
0.1%top 96% das CVEs
exploração observada
nãonenhuma fonte reporta
Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause another user to perform unwanted actions within the application they are logged into. This vulnerability is possible due to the lack of proper CSRF token implementation. Among other things, it is possible, using a POST request to change a user's password or create users via '/setup_login?sid=', affecting the 'username', 'password', and 'cpassword' parameters.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVEs relacionadas — Flexense Sync Breeze Enterprise Server
No mesmo produto, das mais perigosas para as menos.
CVE-2025-59895HIGHRemote denial-of-service (DoS) vulnerability in Sync Breeze Enterprise ServerEPSS 0.4%CVE-2023-49575HIGHXSS vulnerability in VX Search EnterpriseEPSS 0.3%CVE-2023-49572HIGHXSS vulnerability in VX Search EnterpriseEPSS 0.3%CVE-2025-59900MEDIUMAuthenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise ServerEPSS 0.2%CVE-2025-59899MEDIUMAuthenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise ServerEPSS 0.2%CVE-2025-59898MEDIUMAuthenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise ServerEPSS 0.2%