CVE-2025-53693

CVE-2025-53693：HTML缓存投毒 XAML处理器位于 /-/xaml/，暴露了多个无需认证即可访问的控件。这些控件中的 AjaxScriptManager 允许通过反射执行方法。AddToCache 方法可能被滥用以向 Sitecore 缓存中注入任意 HTML 内容，这些内容随后可在应用程序的其他部分渲染。 缓存投毒： 攻击者利用 CVE-2025-53693 向缓存中注入恶意载荷。 缓解措施 Sitecore 已为此漏洞发布补丁。强烈建议升级到最新版本的 Sitecore XP 或应用提供的安全补丁。 参考 1 Watchtowr Labs. 2025...

CVE-2025-53691

CVE-2025-53691: Ejecución remota de código RCE a través de deserialización insegura El mismo mecanismo de reflexión en AjaxScriptManager puede ser utilizado para invocar el método ProcessSerializedData. Este método deserializa un payload proporcionado usando el inseguro BinaryFormatter, lo que...

CVE-2025-53690-Analysis

CVE-2025-53690: Análisis de la vulnerabilidad de deserialización de ViewState en Sitecore Resumen CVE-2025-53690 es una vulnerabilidad de deserialización de ViewState descubierta en la familia de productos Sitecore. Al explotar una machine key de ASP.NET expuesta, permite la ejecución remota de...

CVE-2021-42237-SiteCore-XP

CVE-2021-42237-SiteCore-XP 一样的将需要检测的URL放在target.txt里面 DNSLOG平台自行注册和更改...

CVE-2025-53690

CVE-2025-53690 Sitecore Experience Manager XM 和 Sitecore Experience Platform XP 中存在不受信任数据反序列化漏洞，允许代码注入。此漏洞影响 Experience Manager XM：至 9.0 版本；Experience Platform XP：至 9.0 版本。 这种检测方法的工作原理是什么？ 该 Nuclei 模板获取 sitecore.version.xml，从响应体中提取版本号的前两位数字，构造成 major.minor 格式的字符串，并在页面返回 200、包含“Sitecore...

Metasploit Weekly Wrap-Up 09/19/2025

Consistently Persistent The Metasploit Framework has around 26 different modules which can be used to establish persistence on a target. Persistence modules help operators ensure they can maintain a consistent foothold within an environment once a target has been compromised and are quite helpful...

CVE-2025-53691

CVE-2025-53691 is a Sitecore vulnerability: insecure deserialization in Sitecore Experience Manager (XM) and Experience Platform (XP) can lead to Remote Code Execution (RCE). Affected: XM 9.0–9.3 and 10.0–10.4; XP 9.0–9.3 and 10.0–10.4. Root cause: untrusted data deserialization using insecure pa...

CVE-2015-10142 Sitecore XP < 8.0 and CMS < 7.2 and < 7.5 File Read via Known Path

Sitecore Experience Platform XP prior to 8.0 Initial Release rev. 141212 and Content Management System CMS prior to 7.2 Update-3 rev. 141226 and prior to 7.5 Update-1 rev. 150130 contain a vulnerability that may allow an attacker to download files under the web root of the site when the name of t...

CVE-2015-10142

CVE-2015-10142 affects Sitecore Experience Platform (XP) prior to 8.0 Initial Release and Sitecore CMS prior to 7.2 Update-3 and prior to 7.5 Update-1. The flaw allows an attacker to download files under the web root when the file name is known via a specially crafted URL; allowed file types excl...

CVE-2015-10142 Sitecore XP < 8.0 and CMS < 7.2 and < 7.5 File Read via Known Path

Sitecore Experience Platform XP prior to 8.0 Initial Release rev. 141212 and Content Management System CMS prior to 7.2 Update-3 rev. 141226 and prior to 7.5 Update-1 rev. 150130 contain a vulnerability that may allow an attacker to download files under the web root of the site when the name of t...

Sitecore XM/XP/XC Hardcoded Credentials

Sitecore XM, XP and XC version 9.x = 9.3 or version 10.x 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access administrative API over HTTP. No source data...

CVE-2025-34510 Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip

Sitecore Experience Manager XM, Experience Platform XP, and Experience Commerce XC versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability. A remote, authenticated attacker can exploit this issue by sending a crafted HTTP request to upload a ZIP archive containing...

CVE-2025-34510 Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip

Sitecore Experience Manager XM, Experience Platform XP, and Experience Commerce XC versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability. A remote, authenticated attacker can exploit this issue by sending a crafted HTTP request to upload a ZIP archive containing...

CVE-2025-34509 Sitecore XM and XP Hardcoded Credentials

Sitecore Experience Manager XM and Experience Platform XP versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access...

Sitecore XP CVE-2025-34511 Post-Authentication File Upload

This module exploits CVE-2025-34511, a file upload vulnerability in PowerShell extensions. The module exploits also CVE-2025-34509 - hardcoded credentials of ServicesAPI account - to gain foothold. Module Options msf use exploit/windows/http/sitecore/xpcve202534511 msf undefinedxpcve202534511 sho...

CVE-2019-9874

Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF aka anti CSRF module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter CSRFTOKEN...

Sitecore XM/XP Remote Code Execution

Sitecore XM and XP versions before 10.4 KB1002844 suffer from a deserialization vulnerability through a specially forged request enabling an unauthenticated attacker to execute arbitrary commands. No source data...

CVE-2025-27218

Sitecore Experience Manager XM and Experience Platform XP 10.4 before KB1002844 allow remote code execution through insecure deserialization...

CVE-2023-33653

Sitecore Experience Platform XP v9.3 was discovered to contain an authenticated remote code execution RCE vulnerability via the component /Applications/Content%20Manager/Execute.aspx?cmd=convert&mode=HTML...

CVE-2023-26262

An issue was discovered in Sitecore XP/XM 10.3. As an authenticated Sitecore user, a unrestricted language file upload vulnerability exists the can lead to direct code execution on the content management CM server...