Sitecore Experience_platform
21 CVEs affecting Sitecore Experience_platform. Latest disclosed: 2025-09-03. Critical: 6, High: 12.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-53693 | Critical | 9.8 | 2025-09-03 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experie… |
CVE-2023-35813 | Critical | 9.8 | 2023-06-17 | Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce through 10.3. |
CVE-2023-27068 | Critical | 9.8 | 2023-05-23 | Deserialization of Untrusted Data in Sitecore Experience Platform through 10.2 allows remote attackers to run arbitrary code via ValidationResult.aspx. |
CVE-2021-42237 | Critical | 9.8 | 2021-11-05 | Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command… |
CVE-2019-9874 | Critical | 9.8 | 2019-05-31 | Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unau… |
CVE-2025-53690 | Critical | 9.0 | 2025-09-03 | Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects… |
CVE-2025-53691 | High | 8.8 | 2025-09-03 | Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Remote Code Execution (RCE).This… |
CVE-2025-34511 | High | 8.8 | 2025-06-17 | Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), through version 7.0 is vulnerable to an unrestricte… |
CVE-2025-34510 | High | 8.8 | 2025-06-17 | Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip S… |
CVE-2023-33653 | High | 8.8 | 2023-06-06 | Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /Applications/Con… |
CVE-2023-33652 | High | 8.8 | 2023-06-06 | Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /sitecore/shell/I… |
CVE-2019-11080 | High | 8.8 | 2019-06-06 | Sitecore Experience Platform (XP) prior to 9.1.1 is vulnerable to remote code execution via deserialization, aka TFS # 293863. An authenticated user with neces… |
CVE-2025-53694 | High | 7.5 | 2025-09-03 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP).This i… |
CVE-2025-34509 | High | 7.5 | 2025-06-17 | Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, an… |
CVE-2024-46938 | High | 7.5 | 2024-09-15 | An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0 Initial Release through 10.4 Initial Re… |
CVE-2023-33651 | High | 7.5 | 2023-06-06 | An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initial Release to v13.0… |
CVE-2023-27067 | High | 7.5 | 2023-05-22 | Directory Traversal vulnerability in Sitecore Experience Platform through 10.2 allows remote attackers to download arbitrary files via crafted command to downl… |
CVE-2023-26262 | High | 7.2 | 2023-03-14 | An issue was discovered in Sitecore XP/XM 10.3. As an authenticated Sitecore user, a unrestricted language file upload vulnerability exists the can lead to dir… |
CVE-2023-27066 | Medium | 6.5 | 2023-05-22 | Directory Traversal vulnerability in Site Core Experience Platform 10.2 and earlier allows authenticated remote attackers to download arbitrary files via Urlha… |
CVE-2016-8855 | Medium | 6.1 | 2017-03-19 | Cross-Site Scripting (XSS) in "/sitecore/client/Applications/List Manager/Taskpages/Contact list" in Sitecore Experience Platform 8.1 rev. 160519 (8.1 Update-3… |