SI
Vendor
Sitecore
72
CVEs
14
On KEV
0
New 30D
Products
EP9.8
Experience Platform
Sitecore
21 CVEs3 on KEV0 new
CM9.8
Cms
Sitecore
8 CVEs2 on KEV0 new
CA9.8
CMS and Experience Platform (XP)
Sitecore
2 CVEs2 on KEV0 new
EM9.8
Experience Manager
Sitecore
11 CVEs1 on KEV0 new
EC9.8
Experience Commerce
Sitecore
10 CVEs1 on KEV0 new
MC9.8
Managed Cloud
Sitecore
9 CVEs1 on KEV0 new
EM9.0
Experience Manager (XM)
Sitecore
1 CVEs1 on KEV0 new
EP9.0
Experience Platform (XP)
Sitecore
1 CVEs1 on KEV0 new
MP9.0
Multiple Products
Sitecore
1 CVEs1 on KEV0 new
XP9.8
XP
Sitecore
1 CVEs1 on KEV0 new
CR6.7
Crm
Sitecore
2 CVEs0 on KEV0 new
SI7.5
Sitecore.net
Sitecore
2 CVEs0 on KEV0 new
RO9.8
Rocks
Sitecore
1 CVEs0 on KEV0 new
SI8.8
Sitecore
Sitecore
1 CVEs0 on KEV0 new
SM–
Staging Module
Sitecore
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2025-53690 In wildKEV | EP Experience Platform (XP) Sitecore | 9.0 | Sep 3 | Sitecore Products ViewState Deserialization Vulnerability |
| CVE-2025-53694 | EC Experience Commerce Sitecore | 7.5 | Sep 3 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP).This issue affects… |
| CVE-2025-53693 | EM Experience Manager Sitecore | 9.8 | Sep 3 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP)… |
| CVE-2025-53691 | EC Experience Commerce Sitecore | 8.8 | Sep 3 | Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Remote Code Execution (RCE).This issue affects… |
| CVE-2025-34511 | EC Experience Commerce Sitecore | 8.8 | Jun 17 | Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), through version 7.0 is vulnerable to an unrestricted file upload issue |
| CVE-2025-34510 | MC Managed Cloud Sitecore | 8.8 | Jun 17 | Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability |
| CVE-2025-34509 | EC Experience Commerce Sitecore | 7.5 | Jun 17 | Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev |
| CVE-2024-46938 | EP Experience Platform Sitecore | 7.5 | Sep 15 | An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0 Initial Release through 10.4 Initial Release |
| CVE-2023-35813 | MC Managed Cloud Sitecore | 9.8 | Jun 17 | Multiple Sitecore products allow remote code execution |
| CVE-2023-33653 | EP Experience Platform Sitecore | 8.8 | Jun 6 | Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component… |
| CVE-2023-33652 | EP Experience Platform Sitecore | 8.8 | Jun 6 | Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /sitecore/shell/Invoke.aspx |
| CVE-2023-33651 | EP Experience Platform Sitecore | 7.5 | Jun 6 | An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initial Release to v13.0 Initial Release… |
| CVE-2023-27068 | EP Experience Platform Sitecore | 9.8 | May 23 | Deserialization of Untrusted Data in Sitecore Experience Platform through 10.2 allows remote attackers to run arbitrary code via ValidationResult.aspx |
| CVE-2023-27067 | EP Experience Platform Sitecore | 7.5 | May 22 | Directory Traversal vulnerability in Sitecore Experience Platform through 10.2 allows remote attackers to download arbitrary files via crafted command to download.aspx |
| CVE-2023-27066 | EP Experience Platform Sitecore | 6.5 | May 22 | Directory Traversal vulnerability in Site Core Experience Platform 10.2 and earlier allows authenticated remote attackers to download arbitrary files via Urlhandle |
| CVE-2023-26262 | EM Experience Manager Sitecore | 7.2 | Mar 14 | An issue was discovered in Sitecore XP/XM 10.3 |
| CVE-2021-42237 RansomwareIn wildKEV | EP Experience Platform Sitecore | 9.8 | Nov 5 | Sitecore XP Remote Command Execution Vulnerability |
| CVE-2021-38366 | SI Sitecore Sitecore | 8.8 | Aug 12 | Sitecore through 10.1, when Update Center is enabled, allows remote authenticated users to upload arbitrary files and achieve remote code execution by visiting an uploaded .aspx… |
| CVE-2019-11198 | CM Cms Sitecore | 6.1 | Aug 5 | Multiple cross-site scripting (XSS) vulnerabilities in Sitecore CMS 9.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) #300583 - List… |
| CVE-2019-13493 | EP Experience Platform Sitecore | 5.4 | Jul 17 | In Sitecore 9.0 rev 171002, Persistent XSS exists in the Media Library and File Manager |
| CVE-2019-11080 | EP Experience Platform Sitecore | 8.8 | Jun 6 | Sitecore Experience Platform (XP) prior to 9.1.1 is vulnerable to remote code execution via deserialization, aka TFS # 293863 |
| CVE-2019-9875 In wildKEV | CM Cms Sitecore | 8.8 | May 31 | Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability |
| CVE-2019-9874 In wildKEV | CM Cms Sitecore | 9.8 | May 31 | Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability |
| CVE-2019-12440 | RO Rocks Sitecore | 9.8 | May 29 | The Sitecore Rocks plugin before 2.1.149 for Sitecore allows an unauthenticated threat actor to inject malicious commands and code via the Sitecore Rocks Hard Rocks Service |
| CVE-2018-7669 | SI Sitecore.net Sitecore | 7.5 | Apr 27 | An issue was discovered in Sitecore Sitecore.NET 8.1 rev |
| CVE-2017-11440 | CM Cms Sitecore | 4.9 | Jul 19 | In Sitecore 8.2, there is absolute path traversal via the shell/Applications/Layouts/IDE.aspx fi parameter and the admin/LinqScratchPad.aspx Reference parameter |
| CVE-2017-11439 | CM Cms Sitecore | 5.4 | Jul 19 | In Sitecore 8.2, there is reflected XSS in the shell/Applications/Tools/Run Program parameter |
| CVE-2017-9356 | SI Sitecore.net Sitecore | 6.1 | Jun 23 | Sitecore.NET 7.1 through 7.2 has a Cross Site Scripting Vulnerability via the searchStr parameter to the /Search-Results URI |
| CVE-2017-5966 | CR Crm Sitecore | 4.9 | May 23 | Sitecore CRM 8.1 Rev 151207 allows remote authenticated administrators to read arbitrary files via an absolute path traversal attack on sitecore/shell/download.aspx with the file… |
| CVE-2017-5965 | CR Crm Sitecore | 6.7 | May 23 | The package manager in Sitecore CRM 8.1 Rev 151207 allows remote authenticated administrators to execute arbitrary ASP code by creating a ZIP archive in which a .asp file has a… |
| CVE-2016-8855 | EP Experience Platform Sitecore | 6.1 | Mar 19 | Cross-Site Scripting (XSS) in "/sitecore/client/Applications/List Manager/Taskpages/Contact list" in Sitecore Experience Platform 8.1 rev |
| CVE-2014-100004 | CM Cms Sitecore | – | Jan 13 | Cross-site scripting (XSS) vulnerability in Sitecore CMS before 7.0 Update-4 (rev |
| CVE-2009-4367 | SM Staging Module Sitecore | – | Dec 21 | The Staging Webservice ("sitecore modules/staging/service/api.asmx") in Sitecore Staging Module 5.4.0 rev.080625 and earlier allows remote attackers to bypass authentication and… |
| CVE-2009-2163 | CM Cms Sitecore | – | Jun 22 | Cross-site scripting (XSS) vulnerability in login/default.aspx in Sitecore CMS before 6.0.2 Update-1 090507 allows remote attackers to inject arbitrary web script or HTML via the… |
| CVE-2009-1055 | CM Cms Sitecore | – | Mar 24 | Unspecified vulnerability in the web service in Sitecore CMS 5.3.1 rev |