Skip to content
OpenAdvisories
High WID-SEC-2025-1345 3 CVEs

Sitecore Experience Manager: Mehrere Schwachstellen

Published Jun 17, 2025 · Updated Jun 17, 2025 · de-DE

Vendor: Sitecore Product: Experience Manager Platform: Linux Platform: Windows

Summary

Ein entfernter Angreifer kann mehrere Schwachstellen in Sitecore Experience Manager ausnutzen, um Sicherheitsvorkehrungen zu umgehen, oder um beliebigen Programmcode auszuführen.

Product

Sitecore XM ist ein Content-Management-System. Es ist sowohl als On-Premise-Lösung als auch als Cloud-Angebot verfügbar.

Vulnerabilities 3

  • High 8.8
    CVE-2025-34510 Public exploit EPSS 26%

    Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip

    Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability. A remote, authenticated attacker can exploit this issue by sending a crafted HTTP…

    Sitecore Experience Platform Experience Manager Experience Commerce
  • High 8.8
    CVE-2025-34511 Public exploit EPSS 32%

    Sitecore PowerShell Extension RCE via Unrestricted Upload

    Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), through version 7.0 is vulnerable to an unrestricted file upload issue. A remote, authenticated attacker can upload arbitrary files to the server using…

    Sitecore Powershell Extension
  • High 7.5
    CVE-2025-34509 Scanner template EPSS 56%

    Sitecore XM and XP Hardcoded Credentials

    Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attack…

    Sitecore Experience Platform Experience Manager

Revision history

  1. #1

    Initiale Fassung

References