EP
Product
Experience Platform
On CISA KEVExploited in the wildRansomware-linked
21
CVEs
3
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 12Medium 3Low 0
Watch
Add Experience Platform to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-42237 RansomwareIn wildKEV | 9.8 | Nov 5 | Sitecore XP Remote Command Execution Vulnerability Affected: 7.5; 7.5; 7.5; 8.0; 8.0; 8.0; +18 more |
| CVE-2019-9874 In wildKEV | 9.8 | May 31 | Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability Affected: 7.5 through 8.2 |
| CVE-2025-53690 In wildKEV | 9.0 | Sep 3 | Sitecore Products ViewState Deserialization Vulnerability Affected: through 9.0 |
| CVE-2025-53693 | 9.8 | Sep 3 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP)… Affected: 9.0 before 10.4; 10.4 |
| CVE-2023-35813 | 9.8 | Jun 17 | Multiple Sitecore products allow remote code execution Affected: 8.2 through 10.3 |
| CVE-2023-27068 | 9.8 | May 23 | Deserialization of Untrusted Data in Sitecore Experience Platform through 10.2 allows remote attackers to run arbitrary code via ValidationResult.aspx Affected: before 10.2 |
| CVE-2025-53691 | 8.8 | Sep 3 | Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Remote Code Execution (RCE).This issue affects… Affected: 9.0 before 10.4; 10.4 |
| CVE-2025-34511 | 8.8 | Jun 17 | Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), through version 7.0 is vulnerable to an unrestricted file upload issue Affected: 9.0 before 10.4; 10.4 |
| CVE-2025-34510 | 8.8 | Jun 17 | Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability Affected: 9.0 before 10.4; 10.4 |
| CVE-2023-33653 | 8.8 | Jun 6 | Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component… Affected: 9.3 |
| CVE-2023-33652 | 8.8 | Jun 6 | Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /sitecore/shell/Invoke.aspx Affected: 9.3 |
| CVE-2019-11080 | 8.8 | Jun 6 | Sitecore Experience Platform (XP) prior to 9.1.1 is vulnerable to remote code execution via deserialization, aka TFS # 293863 Affected: before 9.1.1 |
| CVE-2025-53694 | 7.5 | Sep 3 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP).This issue affects… Affected: 9.2 before 10.4; 10.4 |
| CVE-2025-34509 | 7.5 | Jun 17 | Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev Affected: 9.0 before 10.4; 10.4 |
| CVE-2024-46938 | 7.5 | Sep 15 | An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0 Initial Release through 10.4 Initial Release Affected: 8.0 through 10.4 |
| CVE-2023-33651 | 7.5 | Jun 6 | An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initial Release to v13.0 Initial Release… Affected: 9.0 through 10.3 |
| CVE-2023-27067 | 7.5 | May 22 | Directory Traversal vulnerability in Sitecore Experience Platform through 10.2 allows remote attackers to download arbitrary files via crafted command to download.aspx Affected: through 10.2 |
| CVE-2023-26262 | 7.2 | Mar 14 | An issue was discovered in Sitecore XP/XM 10.3 Affected: before 10.3 |
| CVE-2023-27066 | 6.5 | May 22 | Directory Traversal vulnerability in Site Core Experience Platform 10.2 and earlier allows authenticated remote attackers to download arbitrary files via Urlhandle Affected: through 10.2 |
| CVE-2016-8855 | 6.1 | Mar 19 | Cross-Site Scripting (XSS) in "/sitecore/client/Applications/List Manager/Taskpages/Contact list" in Sitecore Experience Platform 8.1 rev Affected: 8.1 |
| CVE-2019-13493 | 5.4 | Jul 17 | In Sitecore 9.0 rev 171002, Persistent XSS exists in the Media Library and File Manager Affected: 9.0 |
Showing 21