WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Product experience manager✕Has a public PoC✕
Overview 14 matches · 1 in Waratek scope · 0 protected · 10 exploited · 2 CISA KEV · 7 EPSS ≥ 0.5
14matches 1in Waratek scope7.1% 0protected0.0% 10exploited71.4% 2CISA KEV14.3% 7EPSS ≥ 0.550.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 1 7.1% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 13 92.9% Withdrawn CVE 0 0.0%
Critical 4 28.6% High 8 57.1% Medium 2 14.3% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 14 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 10 71.4% Working exploit published 4 28.6% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 8 / year
Not applicable: 13Mitigation candidate: 1 Medium: 2High: 8Critical: 4 not blocked: 14 Working exploit published: 4Exploited: 10
20162 Mitigation candidate1 Not applicable1 High2 not blocked2 Working exploit published2 20170 20180 20191 Not applicable1 High1 not blocked1 Working exploit published1 20201 Not applicable1 High1 not blocked1 Working exploit published1 20210 20220 20231 Not applicable1 Critical1 not blocked1 Exploited1 20241 Not applicable1 High1 not blocked1 Exploited1 20258 Not applicable8 Critical3 High3 Medium2 not blocked8 Exploited8
2016201720182019202020212022202320242025
14 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-54251 Medium 2025-09-09 Not applicable Exploited Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an XML Injection vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to manipulate XML queries and gain limited unauthorized write access.
CVE-2025-54249 Medium 2025-09-09 Not applicable Exploited Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to manipulate server-side requests and bypass security controls allowing unauthorized read access.
CVE-2025-53690 Critical 2025-09-03 Not applicable Exploited Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.
CVE-2025-54253 Critical 2025-08-05 Not applicable Exploited Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.
CVE-2025-49533 Critical 2025-07-08 Not applicable Exploited Adobe Experience Manager (MS) versions 6.5.23.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could lead to arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction. Scope is unchanged.
CVE-2025-34511 High 2025-06-17 Not applicable Exploited Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), through version 7.0 is vulnerable to an unrestricted file upload issue. A remote, authenticated attacker can upload arbitrary files to the server using crafted HTTP requests, resulting in remote code execution.
CVE-2025-34510 High 2025-06-17 Not applicable Exploited Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability. A remote, authenticated attacker can exploit this issue by sending a crafted HTTP request to upload a ZIP archive containing path traversal sequences, allowing arbitrary file writes and leading to code execution.
CVE-2025-34509 High 2025-06-17 Not applicable Exploited Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access administrative API over HTTP.
CVE-2024-46938 High 2024-09-15 Not applicable Exploited An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0 Initial Release through 10.4 Initial Release. An unauthenticated attacker can read arbitrary files.
CVE-2023-35813 Critical 2023-06-17 Not applicable Exploited Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce through 10.3.
CVE-2019-16469 High 2020-01-15 Not applicable Working exploit published Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 have an expression language injection vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVE-2019-8086 High 2019-10-25 Not applicable Working exploit published Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVE-2016-0957 High 2016-02-10 Not applicable Working exploit published Dispatcher before 4.1.5 in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0 does not properly implement a URL filter, which allows remote attackers to bypass dispatcher rules via unspecified vectors.
CVE-2016-0956 High 2016-02-10 Mitigation candidate Working exploit published The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows remote attackers to obtain sensitive information via unspecified vectors.