CVE-2025-59901: Flexense Disk Pulse Enterprise

High severity, CVSS 8.5. EPSS: 0.2% chance of exploitation in the next 30 days.

Disk Pulse Enterprise v10.4.18 has an authenticated reflected XSS vulnerability in the '/monitor_directory?sid=' endpoint, caused by insufficient validation of the 'monitor_directory' parameter sent by POST. An attacker could exploit this weakness to send malicious content to an authenticated user and steal information from their session.

Affected products

• Flexense Disk Pulse Enterprise: version v10.4.18 only
• Flexense Sync Breeze Enterprise Server: version v10.4.18 only

Published 2026-01-28. Last modified 2026-06-17.