VULNERABILITY INTELLIGENCE

CVE-2025-59901

EPSS probability0.19%
CISA KEVNot currently listed
Published2026-01-28
Last modified2026-06-17

Description

Disk Pulse Enterprise v10.4.18 has an authenticated reflected XSS vulnerability in the '/monitor_directory?sid=' endpoint, caused by insufficient validation of the 'monitor_directory' parameter sent by POST. An attacker could exploit this weakness to send malicious content to an authenticated user and steal information from their session.

Weakness classification

  • cve-coordination@incibe.es: CWE-352

Primary references