CVE-2025-53690

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.

How does this detection method work?

This Nuclei template fetches sitecore.version.xml, extracts the first two digits of the version number from the body, builds a major.minor string, and matches if the page returns 200, contains “Sitecore Corporation,” and the version is 9.0 or lower.

How do I run this script?

1. Download Nuclei from here
2. Copy the template to your local system
3. Run the following command: nuclei -u https://yourHost.com -t template.yaml

Example Output

References

• https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003865
• https://cloud.google.com/blog/topics/threat-intelligence/viewstate-deserialization-zero-day-vulnerability

Disclaimer

Use at your own risk, I will not be responsible for illegal activities you conduct on infrastructure you do not own or have permission to scan.

Share This Project

---

Contact

Feel free to reach out via Signal if you have any questions.