Sitecore CMS flaw let attackers brute-force 'b' for backdoor

Security researchers at watchTowr disclosed three vulnerabilities in Sitecore Experience Platform — a hardcoded internal admin password, a ZIP path-traversal vulnerability, and an unrestricted file upload — that can be combined to achieve pre-authenticated remote code execution on unpatched instances; the team demonstrated exploitability and reported more than 22,000 exposed Sitecore instances, while Sitecore released patches in version 10.4 on May 11.