Login Request a demo
EP
Product
Experience Platform
by Sitecore · last CVE Sep 3, 2025
On CISA KEVExploited in the wildRansomware-linked
22
CVEs
3
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities22In the news0Timeline
Severity mix
Critical 6High 12Medium 4Low 0
Severity
All severities22Critical6High12Medium4Low0
Exploitation
On CISA KEV3Exploited in the wild3
Watch

Add Experience Platform to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-53691
8.8
2%
Sep 3
Sitecore Experience Remote Code Execution through Insecure Deserialization
Affected: 9.0 before 10.4; 10.4
CVE-2025-34511
8.8
30%
Jun 17
Sitecore PowerShell Extension RCE via Unrestricted Upload
Affected: 9.0 before 10.4; 10.4
CVE-2025-34510
8.8
25%
Jun 17
Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip
Affected: 9.0 through 9.3; 10.0 through 10.4
CVE-2023-33652
8.8
2%
Jun 6
Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /sitecore/shell/Invoke.aspx
Affected: 9.3
CVE-2023-33653
8.8
2%
Jun 6
Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component…
Affected: 9.3
CVE-2019-11080
8.8
14%
Jun 6
Sitecore Experience Platform (XP) prior to 9.1.1 is vulnerable to remote code execution via deserialization, aka TFS # 293863
Affected: before 9.1.1
CVE-2025-53694
7.5
7%
Sep 3
Information Disclosure in ItemServices API
Affected: 9.2 before 10.4; 10.4
CVE-2025-34509
7.5
56%
Jun 17
Sitecore XM and XP Hardcoded Credentials
Affected: 10.4 before 10.4.1 rev. 011941 PRE; 10.3 before 10.3.3 rev. 011967 PRE; 10.2 before 10.3; 10.1 before 10.1.4 rev. 011974 PRE
CVE-2024-46938
7.5
47%
Sep 15
An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0 Initial Release through 10.4 Initial Release
Affected: 8.0 through 10.4
CVE-2023-33651
7.5
1%
Jun 6
An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initial Release to v13.0 Initial Release…
Affected: 9.0 through 10.3
CVE-2023-27067
7.5
2%
May 22
Directory Traversal vulnerability in Sitecore Experience Platform through 10.2 allows remote attackers to download arbitrary files via crafted command to download.aspx
Affected: through 10.2
CVE-2023-26262
7.2
2%
Mar 14
An issue was discovered in Sitecore XP/XM 10.3
Affected: before 10.3
Showing 12