Login Request a demo
SI
Vendor
Sitecore
21 products with CVEs on record
91
CVEs
14
On KEV
0
New 30D
Products
EP
Experience Platform
Sitecore
9.8
22 CVEs3 on KEV0 new
CM
Cms
Sitecore
9.8
8 CVEs2 on KEV0 new
CA
CMS and Experience Platform (XP)
Sitecore
9.8
2 CVEs2 on KEV0 new
EM
Experience Manager
Sitecore
9.8
11 CVEs1 on KEV0 new
MC
Managed Cloud
Sitecore
9.8
11 CVEs1 on KEV0 new
EC
Experience Commerce
Sitecore
9.8
10 CVEs1 on KEV0 new
EP
Experience Platform (XP)
Sitecore
9.8
7 CVEs1 on KEV0 new
EM
Experience Manager (XM)
Sitecore
9.0
3 CVEs1 on KEV0 new
MP
Multiple Products
Sitecore
9.0
1 CVEs1 on KEV0 new
XP
XP
Sitecore
9.8
1 CVEs1 on KEV0 new
SE
Sitecore Experience Manager (XM)
Sitecore
9.8
3 CVEs0 on KEV0 new
CR
Crm
Sitecore
6.7
2 CVEs0 on KEV0 new
SI
Sitecore.net
Sitecore
7.5
2 CVEs0 on KEV0 new
CM
Content Management System (CMS)
Sitecore
6.9
1 CVEs0 on KEV0 new
CM
Content Mangement System (CMS)
Sitecore
5.1
1 CVEs0 on KEV0 new
EC
Experience Commerce (XC)
Sitecore
8.7
1 CVEs0 on KEV0 new
JR
JSS React Sample Application
Sitecore
8.7
1 CVEs0 on KEV0 new
PE
Powershell Extension
Sitecore
8.8
1 CVEs0 on KEV0 new
RO
Rocks
Sitecore
9.8
1 CVEs0 on KEV0 new
SI
Sitecore
Sitecore
8.8
1 CVEs0 on KEV0 new
SM
Staging Module
Sitecore
–
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2025-53692
EP
Experience Platform (XP)
Sitecore
7.1
0%
Sep 21Sitecore Experience Platform Cross-Site Scripting Vulnerability
CVE-2025-53690
In wildKEV
EP
Experience Platform (XP)
Sitecore
9.0
61%
Sep 3Sitecore Products ViewState Deserialization Vulnerability
CVE-2025-53691
EM
Experience Manager (XM)
Sitecore
8.8
2%
Sep 3Sitecore Experience Remote Code Execution through Insecure Deserialization
CVE-2025-53693
EP
Experience Platform (XP)
Sitecore
9.8
20%
Sep 3HTML Cache Poisoning through Unsafe Reflections
CVE-2025-53694
SE
Sitecore Experience Manager (XM)
Sitecore
7.5
7%
Sep 3Information Disclosure in ItemServices API
CVE-2022-4979
EP
Experience Platform
Sitecore
5.1
1%
Jul 25Sitecore XP 7.5 - 10.2, CMS 7.2, and Managed Cloud XSS
CVE-2015-10142
CM
Content Management System (CMS)
Sitecore
6.9
1%
Jul 25Sitecore XP < 8.0 and CMS < 7.2 and < 7.5 File Read via Known Path
CVE-2025-34139
EP
Experience Platform (XP)
Sitecore
8.7
1%
Jul 25Sitecore XM/XP/XC and Managed Cloud 8.0 - 10.4 Arbitrary File Read
CVE-2020-36850
JR
JSS React Sample Application
Sitecore
8.7
1%
Jul 25Sitecore JSS React Sample Application 11.0.0 - 14.0.1 Information Disclosure
CVE-2025-34511
PE
Powershell Extension
Sitecore
8.8
30%
Jun 17Sitecore PowerShell Extension RCE via Unrestricted Upload
CVE-2025-34510
EC
Experience Commerce
Sitecore
8.8
25%
Jun 17Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip
CVE-2025-34509
EP
Experience Platform
Sitecore
7.5
56%
Jun 17Sitecore XM and XP Hardcoded Credentials
CVE-2024-46938
EM
Experience Manager
Sitecore
7.5
47%
Sep 15An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0 Initial Release through 10.4 Initial Release
CVE-2023-35813
EP
Experience Platform
Sitecore
9.8
87%
Jun 17Multiple Sitecore products allow remote code execution
CVE-2023-33653
EP
Experience Platform
Sitecore
8.8
2%
Jun 6Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component…
CVE-2023-33652
EP
Experience Platform
Sitecore
8.8
2%
Jun 6Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /sitecore/shell/Invoke.aspx
CVE-2023-33651
EM
Experience Manager
Sitecore
7.5
1%
Jun 6An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initial Release to v13.0 Initial Release…
CVE-2023-27068
EP
Experience Platform
Sitecore
9.8
2%
May 23Deserialization of Untrusted Data in Sitecore Experience Platform through 10.2 allows remote attackers to run arbitrary code via ValidationResult.aspx
CVE-2023-27067
EP
Experience Platform
Sitecore
7.5
2%
May 22Directory Traversal vulnerability in Sitecore Experience Platform through 10.2 allows remote attackers to download arbitrary files via crafted command to download.aspx
CVE-2023-27066
EP
Experience Platform
Sitecore
6.5
1%
May 22Directory Traversal vulnerability in Site Core Experience Platform 10.2 and earlier allows authenticated remote attackers to download arbitrary files via Urlhandle
CVE-2023-26262
EM
Experience Manager
Sitecore
7.2
2%
Mar 14An issue was discovered in Sitecore XP/XM 10.3
CVE-2021-42237
RansomwareIn wildKEV
EP
Experience Platform
Sitecore
9.8
98%
Nov 5Sitecore XP Remote Command Execution Vulnerability
CVE-2021-38366
SI
Sitecore
Sitecore
8.8
3%
Aug 12Sitecore through 10.1, when Update Center is enabled, allows remote authenticated users to upload arbitrary files and achieve remote code execution by visiting an uploaded .aspx…
CVE-2019-11198
CM
Cms
Sitecore
6.1
1%
Aug 5Multiple cross-site scripting (XSS) vulnerabilities in Sitecore CMS 9.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) #300583 - List…
CVE-2019-13493
EP
Experience Platform
Sitecore
5.4
2%
Jul 17In Sitecore 9.0 rev 171002, Persistent XSS exists in the Media Library and File Manager
CVE-2019-11080
EP
Experience Platform
Sitecore
8.8
14%
Jun 6Sitecore Experience Platform (XP) prior to 9.1.1 is vulnerable to remote code execution via deserialization, aka TFS # 293863
CVE-2019-9875
In wildKEV
CM
Cms
Sitecore
8.8
25%
May 31Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
CVE-2019-9874
In wildKEV
EP
Experience Platform
Sitecore
9.8
84%
May 31Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
CVE-2019-12440
RO
Rocks
Sitecore
9.8
2%
May 29The Sitecore Rocks plugin before 2.1.149 for Sitecore allows an unauthenticated threat actor to inject malicious commands and code via the Sitecore Rocks Hard Rocks Service
CVE-2018-7669
SI
Sitecore.net
Sitecore
7.5
17%
Apr 27An issue was discovered in Sitecore Sitecore.NET 8.1 rev
CVE-2017-11440
CM
Cms
Sitecore
4.9
2%
Jul 19In Sitecore 8.2, there is absolute path traversal via the shell/Applications/Layouts/IDE.aspx fi parameter and the admin/LinqScratchPad.aspx Reference parameter
CVE-2017-11439
CM
Cms
Sitecore
5.4
1%
Jul 19In Sitecore 8.2, there is reflected XSS in the shell/Applications/Tools/Run Program parameter
CVE-2017-9356
SI
Sitecore.net
Sitecore
6.1
1%
Jun 23Sitecore.NET 7.1 through 7.2 has a Cross Site Scripting Vulnerability via the searchStr parameter to the /Search-Results URI
CVE-2017-5966
CR
Crm
Sitecore
4.9
2%
May 23Sitecore CRM 8.1 Rev 151207 allows remote authenticated administrators to read arbitrary files via an absolute path traversal attack on sitecore/shell/download.aspx with the file…
CVE-2017-5965
CR
Crm
Sitecore
6.7
1%
May 23The package manager in Sitecore CRM 8.1 Rev 151207 allows remote authenticated administrators to execute arbitrary ASP code by creating a ZIP archive in which a .asp file has a…
CVE-2016-8855
EP
Experience Platform
Sitecore
6.1
2%
Mar 19Cross-Site Scripting (XSS) in "/sitecore/client/Applications/List Manager/Taskpages/Contact list" in Sitecore Experience Platform 8.1 rev
CVE-2014-100004
CM
Cms
Sitecore
–
2%
Jan 13Cross-site scripting (XSS) vulnerability in Sitecore CMS before 7.0 Update-4 (rev
CVE-2009-4367
SM
Staging Module
Sitecore
–
6%
Dec 21The Staging Webservice ("sitecore modules/staging/service/api.asmx") in Sitecore Staging Module 5.4.0 rev.080625 and earlier allows remote attackers to bypass authentication and…
CVE-2009-2163
CM
Cms
Sitecore
–
3%
Jun 22Cross-site scripting (XSS) vulnerability in login/default.aspx in Sitecore CMS before 6.0.2 Update-1 090507 allows remote attackers to inject arbitrary web script or HTML via the…
CVE-2009-1055
CM
Cms
Sitecore
–
1%
Mar 24Unspecified vulnerability in the web service in Sitecore CMS 5.3.1 rev