Skip to content
CVE PROGRAM SOURCE RECORD9.0 Critical

CVE-2025-53690

Sitecore Products ViewState Deserialization Vulnerability

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Wiz

Description

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Sitecore Experience Manager (XM)

Default version status: unaffected

  • 0 to ≤ 9.0affected

Sitecore Experience Platform (XP)

Default version status: unaffected

  • 0 to ≤ 9.0affected

References