CVE-2025-53694

Published Sep 3, 2025·Updated Jun 17, 2026

NVD Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP).This issue affects Sitecore Experience Manager (XM): from 9.2 through 10.4; Experience Platform (XP): from 9.2 through 10.4.

Public Exploits & PoCs2 found

PoC: CVE-2025-53694-to-CVE-2025-53691

From Information Disclosure to RCE in Sitecore Experience Platform (XP)

PoC: CVE-2025-53694

Information Disclosure in ItemService API with a restricted anonymous user, leading to exposure of cache keys using a brute-force approach

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Start monitoring free