Sitecore Experience Platform vulnerabilities

• sitecore experience manager (xm), experience platform (xp), experience manager +4 more +6 more Sitecore Products ViewState Deserialization Vulnerability CVE-2025-53690 In KEVPublic exploit EPSS 60.7% 9.0 CriticalSeptember 3, 2025
• sitecore experience manager (xm), experience platform (xp), experience manager +3 more +5 more Sitecore Experience Remote Code Execution through Insecure Deserialization CVE-2025-53691 Public exploit 8.8 HighSeptember 3, 2025
• sitecore experience platform (xp), experience manager, experience platform +3 more +5 more HTML Cache Poisoning through Unsafe Reflections CVE-2025-53693 Public exploit EPSS 20.3% 9.8 CriticalSeptember 3, 2025
• sitecore experience platform (xp), experience manager, experience platform +3 more +5 more Information Disclosure in ItemServices API CVE-2025-53694 Public exploit 7.5 HighSeptember 3, 2025
• sitecore experience manager, experience platform, powershell extension +2 more +4 more Sitecore PowerShell Extension RCE via Unrestricted Upload CVE-2025-34511 Public exploit EPSS 30.4% 8.8 HighJune 17, 2025
• sitecore experience commerce, experience manager, experience platform +1 more +3 more Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip CVE-2025-34510 Public exploit EPSS 24.8% 8.8 HighJune 17, 2025
• sitecore experience manager, experience platform, experience commerce +1 more +3 more Sitecore XM and XP Hardcoded Credentials CVE-2025-34509 EPSS 55.9% 7.5 HighJune 17, 2025
• sitecore experience commerce, experience manager, experience platform +2 more An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and... CVE-2024-46938 EPSS 46.8% 7.5 HighSeptember 15, 2024
• sitecore experience commerce, experience manager, experience platform +1 more +3 more Multiple Sitecore products allow remote code execution. This affects Experience Manager,... CVE-2023-35813 Public exploit EPSS 86.7% 9.8 CriticalJune 17, 2023
• sitecore experience platform Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code... CVE-2023-33653 8.8 HighJune 6, 2023
• sitecore experience platform Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code... CVE-2023-33652 8.8 HighJune 6, 2023
• sitecore experience commerce, experience manager, experience platform +1 more +3 more An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM... CVE-2023-33651 7.5 HighJune 6, 2023
• sitecore experience platform Deserialization of Untrusted Data in Sitecore Experience Platform through 10.2 allows remote... CVE-2023-27068 9.8 CriticalMay 23, 2023
• sitecore experience platform Directory Traversal vulnerability in Sitecore Experience Platform through 10.2 allows remote... CVE-2023-27067 7.5 HighMay 22, 2023
• sitecore experience platform Directory Traversal vulnerability in Site Core Experience Platform 10.2 and earlier allows... CVE-2023-27066 6.5 MediumMay 22, 2023
• sitecore experience manager, experience platform +1 more An issue was discovered in Sitecore XP/XM 10.3. As an authenticated Sitecore user, a unrestricted... CVE-2023-26262 Public exploit 7.2 HighMarch 14, 2023
• sitecore xp, experience platform +1 more Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure... CVE-2021-42237 In KEVPublic exploit EPSS 97.6% 9.8 CriticalNovember 5, 2021
• sitecore experience platform In Sitecore 9.0 rev 171002, Persistent XSS exists in the Media Library and File Manager. An... CVE-2019-13493 Public exploit 5.4 MediumJuly 17, 2019
• sitecore experience platform Sitecore Experience Platform (XP) prior to 9.1.1 is vulnerable to remote code execution via... CVE-2019-11080 Public exploit EPSS 13.9% 8.8 HighJune 6, 2019
• sitecore cms, cms and experience platform (xp), experience platform +2 more Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in... CVE-2019-9874 In KEV EPSS 83.7% 9.8 CriticalMay 31, 2019
• sitecore experience platform Cross-Site Scripting (XSS) in "/sitecore/client/Applications/List Manager/Taskpages/Contact list"... CVE-2016-8855 Public exploit 6.1 MediumMarch 19, 2017