## https://sploitus.com/exploit?id=AD8AB9C4-AFFF-52EE-A78C-848479E0C771
# CVE-2025-53690
Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.
## How does this detection method work?
This Nuclei template fetches sitecore.version.xml, extracts the first two digits of the version number from the body, builds a major.minor string, and matches if the page returns 200, contains “Sitecore Corporation,” and the version is 9.0 or lower.
## How do I run this script?
1. Download Nuclei from [here](https://github.com/projectdiscovery/nuclei)
2. Copy the template to your local system
3. Run the following command: `nuclei -u https://yourHost.com -t template.yaml`
### Example Output
## References
- https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003865
- https://cloud.google.com/blog/topics/threat-intelligence/viewstate-deserialization-zero-day-vulnerability
## Disclaimer
Use at your own risk, I will not be responsible for illegal activities you conduct on infrastructure you do not own or have permission to scan.
## Share This Project
---
## Contact
Feel free to reach out via [Signal](https://signal.me/#eu/0Qd68U1ivXNdWCF4hf70UYFo7tB0w-GQqFpYcyV6-yr4exn2SclB6bFeP7wTAxQw) if you have any questions.