CVE-2023-35813

CVE-2023-35813 CVE-2023-35813 es una prueba de concepto utilizada para determinar si una instancia de Sitecore es vulnerable analizando un Encabezado de respuesta del servidor en busca de modificaciones. Hecho con amor por heretic 3...

CVE-2025-53691

CVE-2025-53691: Ejecución remota de código RCE a través de deserialización insegura El mismo mecanismo de reflexión en AjaxScriptManager puede ser utilizado para invocar el método ProcessSerializedData. Este método deserializa un payload proporcionado usando el inseguro BinaryFormatter, lo que...

Sitecore.Solr-log4j-mitigation

Sitecore.Solr-log4j-mitigation CVE-2021-44228 Este repositorio contiene un script que puedes ejecutar en tu máquina Windows para mitigar CVE-2021-44228 aplicando el consejo documentado en https://solr.apache.org/security.htmlapache-solr-affected-by-apache-log4j-cve-2021-44228 El script de...

Sitecore Experience Manager (XM) and Experience Platform (XP) - Hardcoded Credentials

Sitecore Experience Manager XM and Experience Platform XP versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access...

Sitecore CMS - Cross-Site Scripting

Sitecore CMS contains a cross-site scripting vulnerability via the "special way" of displaying XML Controls directly, which allows for a Cross Site Scripting Attack. id: CVE-2014-100004 info: name: Sitecore CMS - Cross-Site Scripting author: DhiyaneshDK severity: medium description: | Sitecore CM...

CVE-2025-53694

CVE-2025-53694: Information Disclosure in ItemService API with a restricted anonymous user, leading to exposure of cache keys using a brute-force approach The ItemService API, accessible at /sitecore/shell/api/sitecore/ItemService/GetChildren, allows unauthenticated users to query the Sitecore...

CVE-2025-53694-to-CVE-2025-53691

Exploits de la Cadena CVE de Sitecore Este repositorio contiene exploits de prueba de concepto para una cadena de vulnerabilidades críticas en Sitecore Experience Platform XP versiones hasta 10.4.1. Vulnerabilidades CVE-2025-53694: Divulgación de Información CVE-2025-53693: Envenenamiento de Cach...

CVE-2025-53693

CVE-2025-53693: HTML Cache Poisoning The XAML handler, located at /-/xaml/, exposes several controls that can be accessed without authentication. The AjaxScriptManager within these controls allows for the execution of methods via reflection. The AddToCache method can be abused to inject arbitrary...

CVE-2023-35813

CVE-2023-35813 - Sitecore RCE...

Sitecore Experience Manager (XM)/Experience Platform (XP) 10.4 - Insecure Deserialization

Sitecore Experience Manager XM and Experience Platform XP 10.4 before KB1002844 allow remote code execution through insecure deserialization. id: CVE-2025-27218 info: name: Sitecore Experience Manager XM/Experience Platform XP 10.4 - Insecure Deserialization author: iamnoooob,rootxharsh,pdresearc...

Sitecore Experience Platform <= 10.4 - Arbitrary File Read

An issue was discovered in Sitecore Experience Platform XP, Experience Manager XM, and Experience Commerce XC 8.0 Initial Release through 10.4 Initial Release. An unauthenticated attacker can read arbitrary files. id: CVE-2024-46938 info: name: Sitecore Experience Platform = 10.4 - Arbitrary File...

CVE-2021-42237

CVE-2021-42237 This is an exploit/PoC for CVE-2021-42237 taken from: This Assetnote report DISCLAIMER: I'm not associated with Assetnote in any way or form. This content is provided for educational porpouses only. Make sure to replace CMD-COMMAND-HERE, as well as the Host, from the PoC below: POS...

CVE-2021-42237-SiteCore-XP

CVE-2021-42237-SiteCore-XP Similarly, put the URLs to be detected in target.txt Register and modify the DNSLOG platform yourself...

CVE-2023-35813_PoC

curl -k -v -X POST "https://target/sitecorexaml.ashx/-/xaml/Sitecore.Xaml.Tutorials.Styles.Index" -H "Content-Type: application/x-www-form-urlencoded" --data-urlencode "ISEVENT=1" --data-urlencode "SOURCE=" --data-urlencode "PARAMETERS=ParseControl" ""...

CVE-2025-53690-POC

Sitecore Critical Deserialization RCE CVE-2025-53690 POC and Nuclei Template Short summary This repository hosts a detection template and supporting materials for CVE-2025-53690 Sitecore. The included Nuclei template helps scan for Sitecore instances that appear to be configured in a way that cou...

CVE-2023-35813-PoC

Sitecore Vulnerabilidad de Ejecución Remota de Código CVE: 2023-35813 descubierta por @mwulftange CVSS Score: 9.8 Severity: Crítica Esta es la fantástica publicación del blog de los investigadores que la encontraron: https://code-white.com/blog/exploiting-asp.net-templateparser-part-1/ Determina...

CVE-2025-53690

CVE-2025-53690 Vulnerabilidad de deserialización de datos no confiables en Sitecore Experience Manager XM y Sitecore Experience Platform XP que permite inyección de código. Esta vulnerabilidad afecta a Experience Manager XM: hasta la versión 9.0; Experience Platform XP: hasta la versión 9.0. ¿Cóm...

SiteCore-RCE-Detection

SiteCore-RCE-Detection For detection of sitecore RCE - CVE-2021-42237 Sitecore Experience Platform Pre-Auth RCE - CVE-2021-42237 Relies on sitecore version detection and response when a request is made to vulnerale Report.ashx via Get and Post. The script takes a file containing list of urls in...

CVE-2023-26262

Sitecore 10.3 Vulnerabilidad de carga de archivos autenticada Autor: Thomas Stern Fecha: 26/01-2023 Resumen Es posible, mediante la funcionalidad de importación de idiomas, cargar un archivo arbitrario. Este archivo podría ser una webshell que permitiría la ejecución de código en el servidor. Pas...

CVE-2025-53690-Analysis

CVE-2025-53690: Sitecore ViewState Deserialization Vulnerability Analysis Overview CVE-2025-53690 is a critical ViewState deserialization vulnerability discovered in the Sitecore product suite, allowing remote code execution by exploiting exposed ASP.NET machine keys. Basic Information CVE ID :...