CVE-2025-53694

🗓️ 03 Sep 2025 12:36:37Reported by WizType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 28 Views🌐 WEB

Exposure of sensitive information to an unauthorized actor in Sitecore Experience Manager and Sitecore Experience Platform 9.2–10.4.

Reporter	Title	Published	Views	Family All 11
GithubExploit	Exploit for CVE-2025-53691	1 Sep 202514:43	–	githubexploit
GithubExploit	Exploit for CVE-2025-53694	1 Sep 202514:36	–	githubexploit
Circl	CVE-2025-53694	29 Aug 202514:35	–	circl
CNNVD	Sitecore Experience Manager 安全漏洞	3 Sep 202500:00	–	cnnvd
Cvelist	CVE-2025-53694 Information Disclosure in ItemServices API	3 Sep 202512:36	–	cvelist
EUVD	EUVD-2025-26501	3 Oct 202520:07	–	euvd
NVD	CVE-2025-53694	3 Sep 202513:15	–	nvd
Positive Technologies	PT-2025-35315	29 Aug 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-53694	5 Sep 202513:28	–	redhatcve
The Hacker News	Researchers Warn of Sitecore Exploit Chain Linking Cache Poisoning and Remote Code Execution	29 Aug 202517:22	–	thn

NVD

Node

sitecore experience_commerceRange9.2–10.4

sitecore experience_managerRange9.2–10.4

sitecore experience_platformRange9.2–10.4

sitecore experience_platformMatch10.4-

sitecore managed_cloudMatch-

[
  {
    "defaultStatus": "unaffected",
    "product": "Sitecore Experience Manager (XM)",
    "vendor": "Sitecore",
    "versions": [
      {
        "lessThanOrEqual": "10.4",
        "status": "affected",
        "version": "9.2",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Experience Platform (XP)",
    "vendor": "Sitecore",
    "versions": [
      {
        "lessThanOrEqual": "10.4",
        "status": "affected",
        "version": "9.2",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
support	www.support.sitecore.com/kb
labs	www.labs.watchtowr.com/cache-me-if-you-can-sitecore-experience-platform-cache-poisoning-to-rce/

Parameter	Position	Path	Description	CWE
database	query param	/sitecore/shell/api/sitecore/ItemService/GetChildren	Unauthenticated access to GetChildren can be used to enumerate Sitecore items by supplying an item GUID and database name.	CWE-200
item	query param	/sitecore/shell/api/sitecore/ItemService/GetChildren	Unauthenticated access to GetChildren can be used to enumerate Sitecore items by supplying an item GUID and database name.	CWE-200

08 Sep 2025 18:11Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.17.5

EPSS0.05343

SSVC

CWE-200