CVE-2025-53693

HTML Cache Poisoning through Unsafe Reflections

State: Published
Severity: 9.8 Critical
Published: Sep 3, 2025
Updated: Sep 3, 2025
Reserved: Jul 8, 2025

Description

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cache Poisoning.This issue affects Sitecore Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform (XP): from 9.0 through 9.3, from 10.0 through 10.4.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Wiz

Weaknesses

CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Affected Products

Product	Versions
Sitecore Experience Manager (XM)Sitecore	9.0 through 9.3Affected 10.0 through 10.4Affected
Experience Platform (XP)Sitecore	9.0 through 9.3Affected 10.0 through 10.4Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.