Critical WID-SEC-2025-1542 4 CVEs

Sitecore Experience Manager: Mehrere Schwachstellen

Published Jul 13, 2025 · Updated Sep 21, 2025 · Revision 5 · de-DE

Vendor: Sitecore Product: Experience Manager Platform: Windows

Summary

Ein entfernter Angreifer kann mehrere Schwachstellen in Sitecore Experience Manager ausnutzen, um beliebigen Programmcode auszuführen oder vertrauliche Informationen offenzulegen.

Product

Sitecore XM ist ein Content-Management-System. Es ist sowohl als On-Premise-Lösung als auch als Cloud-Angebot verfügbar.

Vulnerabilities 4

Critical 9.8

CVE-2025-53693 Public exploit EPSS 20%

HTML Cache Poisoning through Unsafe Reflections

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cache Poisoning.This issue affects Sitecore Experience Manager (XM): from 9…

Sitecore Experience Platform (XP) Sitecore Experience Manager (XM)

Sep 3, 2025
High 8.8

CVE-2025-53691 Public exploit

Sitecore Experience Remote Code Execution through Insecure Deserialization

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Remote Code Execution (RCE).This issue affects Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Plat…

Sitecore Experience Platform (XP) Experience Manager (XM)

Sep 3, 2025
High 7.5

CVE-2025-53694 Public exploit

Information Disclosure in ItemServices API

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP).This issue affects Sitecore Experience Manager (XM): from 9.2 through 10.4; Experience Platform (XP): from…

Sitecore Experience Platform (XP) Sitecore Experience Manager (XM)

Sep 3, 2025
High 7.1

CVE-2025-53692

Sitecore Experience Platform Cross-Site Scripting Vulnerability

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cross-Site Scripting (XSS).This issue affects Sitecore Experience …

Sitecore Experience Platform (XP) Sitecore Experience Manager (XM)

Sep 21, 2025

Revision history

2025-09-21 #5
CVE ergänzt
2025-09-03 #4
Referenz(en) aufgenommen: EUVD-2025-26500, EUVD-2025-26499, EUVD-2025-26501
2025-09-01 #3
Exploit aufgenommen
2025-08-28 #2
CVE-Nummern ergänzt
2025-07-13 #1
Initiale Fassung

References

Sitecore Security Bulletin vom 2025-07-11
https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003734
Exploits auf GitHub vom 2025-09-01
https://github.com/blueisbeautiful/CVE-2025-53694-to-CVE-2025-53691