CVE-2025-59894

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-59894
Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause another user to perform unwanted actions within the application they are logged into. This vulnerability is possible due to the lack of proper CSRF token implementation. Among other things, it is possible, using a POST request to delete all commands via '/delete_all_commands?sid='.

8.0 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.1 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-flexense-products Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:flexense:diskpulse:10.4.18:*:*:*:enterprise:*:*:*
cpe:2.3:a:flexense:syncbreeze:10.4.18:*:*:*:enterprise:*:*:*
History

17 Jun 2026, 09:46

Type Values Removed Values Added
Summary
  • (es) Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en Sync Breeze Enterprise Server v10.4.18 y Disk Pulse Enterprise v10.4.18. Un usuario autenticado podría causar que otro usuario realice acciones no deseadas dentro de la aplicación en la que ha iniciado sesión. Esta vulnerabilidad es posible debido a la falta de una implementación adecuada de token CSRF. Entre otras cosas, es posible, utilizando una petición POST, eliminar todos los comandos a través de '/delete_all_commands?sid='.

10 Feb 2026, 21:08

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.0
First Time Flexense syncbreeze
Flexense diskpulse
Flexense
CPE cpe:2.3:a:flexense:syncbreeze:10.4.18:*:*:*:enterprise:*:*:*
cpe:2.3:a:flexense:diskpulse:10.4.18:*:*:*:enterprise:*:*:*
References () https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-flexense-products - () https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-flexense-products - Third Party Advisory

28 Jan 2026, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-28 12:15

Updated : 2026-06-17 09:46

NVD link : CVE-2025-59894

Mitre link : CVE-2025-59894

CVE.ORG link : CVE-2025-59894

JSON object : View

Products Affected

flexense

  • diskpulse
  • syncbreeze
CWE
CWE-352

Cross-Site Request Forgery (CSRF)