CVE-2025-53692: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Sitecore Sitecore Experience Manager XM, Sitecore Experience Platform XP allows Cross-Site Scripting XSS.This issue affects Sitecore Experience Manager XM: from 9.2 through 10.4; Experience...

CVE-2025-53691: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager XM, Sitecore Experience Platform XP allows Remote Code Execution RCE.This issue affects Experience Manager XM: from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform XP: from 9.0 through 9.3, from 10.0 throu...

CVE-2025-53690: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager XM, Sitecore Experience Platform XP allows Code Injection.This issue affects Experience Manager XM: through 9.0; Experience Platform XP: through 9.0...

CVE-2025-53694: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager XM, Sitecore Experience Platform XP.This issue affects Sitecore Experience Manager XM: from 9.2 through 10.4; Experience Platform XP: from 9.2 through 10.4...

CVE-2025-53693: Use of Externally-Controlled Input to Select Classes or Code

Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Sitecore Sitecore Experience Manager XM, Sitecore Experience Platform XP allows Cache Poisoning.This issue affects Sitecore Experience Manager XM: from 9.0 through 9.3, from 10.0 through 10.4;...

CVE-2025-34509: Use of Hard-coded Credentials

Sitecore Experience Manager XM and Experience Platform XP versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access...