- Description
- Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access administrative API over HTTP.
- Source
- disclosure@vulncheck.com
- NVD status
- Modified
- Products
- experience_commerce, experience_manager, experience_platform, managed_cloud
CVSS 3.1
- Type
- Primary
- Base score
- 7.5
- Impact score
- 3.6
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Severity
- HIGH
- disclosure@vulncheck.com
- CWE-798
- Hype score
- Not currently trending
🚨 From Cloudflare Security Research Analysts 🚨 Fresh CVEs patched for Cloudflare WAF customers: 🔐 Sitecore (CVE-2025-34509/10/11): RCE via hardcoded creds + file upload 🧪 Grafana (CVE-2025-4123): XSS → malicious redirect ⚙️ LaRecipe (CVE-2025-53833): SSTI
@Cloudflare
5 Aug 2025
7907 Impressions
16 Retweets
61 Likes
12 Bookmarks
2 Replies
0 Quotes
Pesquisadores descobriram três #vulnerabilidades no popular sistema #Sitecore Experience Platform: CVE-2025-34509 senha embutida no código. CVE-2025-34510 vulnerabilidade Zip Slip. CVE-2025-34511 permite que os usuários carreguem arquivos externos. https://t.co/rmIPS0G977
@EChavarro
7 Jul 2025
24 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
3 vulnerabilidades en el sistema de administración de contenidos #Sitecore Experience Platform: - CVE-2025-34509 #contraseña codificada de forma rígida - CVE-2025-34510 es una #vulnerabilidad de Zip Slip - CVE-2025-34511 cargar archivos sin restricciones https://t.co/RvWjroYP
@EChavarro
1 Jul 2025
17 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sitecore:experience_commerce:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DCF77DC5-9DF9-4DF7-9636-69CA4BEEDB04",
"versionEndIncluding": "10.4",
"versionStartIncluding": "9.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sitecore:experience_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "17EF29D0-E1DA-4F84-95F4-EA9680EB47DF",
"versionEndIncluding": "10.4",
"versionStartIncluding": "9.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sitecore:experience_platform:*:*:*:*:*:*:*:*",
"matchCriteriaId": "88455751-A525-4A59-9DD8-4E015CD1346C",
"versionEndExcluding": "10.4",
"versionStartIncluding": "9.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sitecore:experience_platform:10.4:-:*:*:*:*:*:*",
"matchCriteriaId": "78E71AD1-04C7-4D80-9A0A-E386A3FAC860",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sitecore:managed_cloud:-:*:*:*:*:*:*:*",
"matchCriteriaId": "520CF670-01A2-479F-B637-C413A82463E0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]