Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Tools/GitHubGitHub/blueisbeautiful/cve-2025-53694-to-cve-2025-53691
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingLearning & EducationPayload Development
GitHubblueisbeautiful/cve-2025-53694-to-cve-2025-53691

CVE-2025-53694-to-CVE-2025-53691

From Information Disclosure to RCE in Sitecore Experience Platform (XP)

View Repository
21 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Sitecore CVE Chain Exploits

This repository contains proof-of-concept exploits for a critical vulnerability chain in Sitecore Experience Platform (XP) versions up to 10.4.1.

Vulnerabilities

  • CVE-2025-53694: Information Disclosure
  • CVE-2025-53693: Cache Poisoning
  • CVE-2025-53691: Remote Code Execution

Exploits

All 3 exploits are available separately in my profile, the chain.py file contains the logic of the 3 orchestrated in a chain for cache poisoning to RCE escalation, the cve_2025_5369*.py files mentioned below were redundant and have been removed.

  • cve_2025_53694.py: Information Disclosure PoC // Removed
  • cve_2025_53693.py: Cache Poisoning PoC // Removed
  • cve_2025_53691.py: RCE via Deserialization PoC // Removed
  • chain.py: Complete exploit chain (all CVEs)
  • sitecore.yaml: Nuclei template, not validated or tested on real targets
  • test.py: Test script for local environment, make sure to set the correct port // Temporarily removed, incomplete detection

    • Usage

    Individual Exploits

    • CVE-2025-53694: python3 exploit.py <target_url>
    • CVE-2025-53693: python3 exploit.py <target_url>
    • CVE-2025-53691: python3 exploit.py <target_url> --command "<command>"

    Exploit Chain

    root@kitploit:~
    python3 chain.py <target_url> --command "<command>"

    Nuclei template

    • Download go
    • Install nuclei
    • Run nuclei -t sitecore.yaml -u <target_url> or cat targets.txt | nuclei -t sitecore.yaml

    Documentation

    See full explanation here

    Disclaimer

    These exploits are for educational and research purposes only. Do not use them on systems you do not own or have permission to test.

    Download Tool