Export limit exceeded: 425536 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 11

Export CSV
CVE-2025-59901

authenticated reflected XSS vulnerability in Sync Breeze Enterprise Server

Disk Pulse Enterprise v10.4.18 has an authenticated reflected XSS vulnerability in the '/monitor_directory?sid=' endpoint, caused by insufficient validation of the 'monitor_directory' parameter sent by POST. An attacker could exploit this weakness to send malicious content to an authenticated user and steal information from their session.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Flexense
Products
Disk Pulse Enterprise Sync Breeze Enterprise Server
CVE-2025-59891

Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server

Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause another user to perform unwanted actions within the application they are logged into. This vulnerability is possible due to the lack of proper CSRF token implementation. Among other things, it is possible, using a POST request to change a user's password or create users via '/setup_login?sid=', affecting the 'username', 'password', and 'cpassword' parameters.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Flexense
Products
Disk Pulse Enterprise Diskpulse Sync Breeze Enterprise Server and 1 more
CVE-2025-59892

Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server

Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause another user to perform unwanted actions within the application they are logged into. This vulnerability is possible due to the lack of proper CSRF token implementation. Among other things, it is possible, using a POST request to delete commands individually via '/delete_command?sid=', using the 'cid' parameter.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Flexense
Products
Disk Pulse Enterprise Diskpulse Sync Breeze Enterprise Server and 1 more
CVE-2025-59893

Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server

Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause another user to perform unwanted actions within the application they are logged into. This vulnerability is possible due to the lack of proper CSRF token implementation. Among other things, it is possible, using a POST request to rename commands via '/rename_command?sid=', affecting the 'command_name' parameter.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Flexense
Products
Disk Pulse Enterprise Diskpulse Sync Breeze Enterprise Server and 1 more
CVE-2025-59894

Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server

Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause another user to perform unwanted actions within the application they are logged into. This vulnerability is possible due to the lack of proper CSRF token implementation. Among other things, it is possible, using a POST request to delete all commands via '/delete_all_commands?sid='.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Flexense
Products
Disk Pulse Enterprise Diskpulse Sync Breeze Enterprise Server and 1 more
CVE-2025-59895

Remote denial-of-service (DoS) vulnerability in Sync Breeze Enterprise Server

Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a remote denial-of-service (DoS) vulnerability in the configuration restore functionality. The issue is due to insufficient validation of user-supplied data during this process. An attacker could send malicious requests to alter the configuration file, causing the application to become unresponsive. In a successful scenario, the service may not recover on its own and require a complete reinstallation, as the configuration becomes corrupted and prevents the service from restarting, even manually.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Flexense
Products
Disk Pulse Enterprise Diskpulse Sync Breeze Enterprise Server and 1 more
CVE-2025-59896

Authenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise Server

Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attacker could send malicious content to an authenticated user and steal information from their session due to insufficient validation of user input in '/add_command?sid=', affecting the 'command_name' parameter.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Flexense
Products
Disk Pulse Enterprise Diskpulse Sync Breeze Enterprise Server and 1 more
CVE-2025-59897

Authenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise Server

Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attacker could send malicious content to an authenticated user and steal information from their session due to insufficient validation of user input in '/edit_command?sid=', affecting the 'source_dir' and ‘dest_dir’ parameters.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Flexense
Products
Disk Pulse Enterprise Diskpulse Sync Breeze Enterprise Server and 1 more
CVE-2025-59898

Authenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise Server

Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attacker could send malicious content to an authenticated user and steal information from their session due to insufficient validation of user input in '/add_exclude_dir?sid=', affecting the 'exclude_dir' parameter.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Flexense
Products
Disk Pulse Enterprise Diskpulse Sync Breeze Enterprise Server and 1 more
CVE-2025-59899

Authenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise Server

Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attacker could send malicious content to an authenticated user and steal information from their session due to insufficient validation of user input in  '/server_options?sid=', affecting the 'tasks_logs_dir', 'errors_logs_dir', 'error_notifications_address', 'status_notifications_address', and 'status_reports_address' parameters.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Flexense
Products
Disk Pulse Enterprise Diskpulse Sync Breeze Enterprise Server and 1 more
CVE-2025-59900

Authenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise Server

Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attacker could send malicious content to an authenticated user and steal information from their session due to insufficient validation of user input in  '/server_options?sid=', affecting the 'tasks_logs_dir', 'errors_logs_dir', 'error_notifications_address', 'status_notifications_address', and 'status_reports_address' parameters.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Flexense
Products
Disk Pulse Enterprise Diskpulse Sync Breeze Enterprise Server and 1 more