WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product experience manager✕
Overview 11 matches · 0 in Waratek scope · 0 protected · 2 CISA KEV · 10 public PoC · 6 EPSS ≥ 0.5
11matches 0in Waratek scope0.0% 0protected0.0% 2CISA KEV18.2% 10public PoC90.9% 6EPSS ≥ 0.554.5%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 11 100.0% Withdrawn CVE 0 0.0%
Critical 4 36.4% High 5 45.5% Medium 2 18.2% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 11 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 11 100.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 6 / quarter
Not applicable: 11 Medium: 2High: 5Critical: 4 not blocked: 11 Exploited: 11
Q2 231 Not applicable1 Critical1 not blocked1 Exploited1 Q3 230 Q4 230 Q1 240 Q2 240 Q3 241 Not applicable1 High1 not blocked1 Exploited1 Q4 240 Q1 250 Q2 253 Not applicable3 High3 not blocked3 Exploited3 Q3 256 Not applicable6 Critical3 High1 Medium2 not blocked6 Exploited6
Q2 23Q3 23Q4 23Q1 24Q2 24Q3 24Q4 24Q1 25Q2 25Q3 25
11 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-54251 Medium 2025-09-09 Not applicable Exploited Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an XML Injection vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to manipulate XML queries and gain limited unauthorized write access.
CVE-2025-54249 Medium 2025-09-09 Not applicable Exploited Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to manipulate server-side requests and bypass security controls allowing unauthorized read access.
CVE-2025-53690 Critical 2025-09-03 Not applicable Exploited Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.
CVE-2025-54254 High 2025-08-05 Not applicable Exploited Adobe Experience Manager versions 6.5.23 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files on the local file system, scope is changed. Exploitation of this issue does not require user interaction.
CVE-2025-54253 Critical 2025-08-05 Not applicable Exploited Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.
CVE-2025-49533 Critical 2025-07-08 Not applicable Exploited Adobe Experience Manager (MS) versions 6.5.23.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could lead to arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction. Scope is unchanged.
CVE-2025-34511 High 2025-06-17 Not applicable Exploited Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), through version 7.0 is vulnerable to an unrestricted file upload issue. A remote, authenticated attacker can upload arbitrary files to the server using crafted HTTP requests, resulting in remote code execution.
CVE-2025-34510 High 2025-06-17 Not applicable Exploited Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability. A remote, authenticated attacker can exploit this issue by sending a crafted HTTP request to upload a ZIP archive containing path traversal sequences, allowing arbitrary file writes and leading to code execution.
CVE-2025-34509 High 2025-06-17 Not applicable Exploited Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access administrative API over HTTP.
CVE-2024-46938 High 2024-09-15 Not applicable Exploited An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0 Initial Release through 10.4 Initial Release. An unauthenticated attacker can read arbitrary files.
CVE-2023-35813 Critical 2023-06-17 Not applicable Exploited Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce through 10.3.