CVE-2021-42237

CVE-2021-42237 – Sitecore XP is an insecure deserialization vulnerability affecting Sitecore Experience Platform 7.5 to 8.2 Update-7, enabling remote code execution without authentication. Concrete details across connected docs show vulnerable versions include Sitecore XP 7.5.x (7.5.0–7.5.2) and ...

CVE-2019-9874

CVE-2019-9874 affects Sitecore CMS 7.0–7.2 and Sitecore XP 7.5–8.2 via the Sitecore.Security.AntiCSRF deserialization module. An unauthenticated attacker can trigger remote code execution by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN**, exploiting untrusted data deser...

CVE-2025-53690

CVE-2025-53690 affects Sitecore XM/XP (through 9.0) with a Deserialization of Untrusted Data vulnerability that can enable remote code execution. Connected sources provide concrete details: a PoC exploit targeting a .NET deserialization path (ViewState/Asp.NET machine keys) and reports of remote ...

CVE-2023-35813

Sitecore CVE-2023-35813 affects Experience Manager, Experience Platform, and Experience Commerce up to version 10.3. The root cause is remote code execution via the XAML parser triggered by injecting malicious ASP.NET markup, enabling unauthenticated arbitrary code execution on Sitecore servers a...

CVE-2024-46938

CVE-2024-46938 affects Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0 Initial Release through 10.4 Initial Release. An unauthenticated attacker can read arbitrary files due to an improper path access check in the affected Sitecore components. Affected...

CVE-2025-34509

Sitecore XM/XP affected: Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE; root cause is a hardcoded user account that allows unauthenticated, remote access to the ad...

CVE-2019-11080

Sitecore Experience Platform (XP) prior to 9.1.1 is affected by a deserialization-based remote code execution vulnerability (CVE-2019-11080). An authenticated user with the required permissions can remotely execute OS commands by sending a crafted serialized object. Public sources (including Red ...

CVE-2019-13493

Sitecore 9.0 rev 171002 is affected by a Persistent XSS in the Media Library and File Manager. An authenticated unprivileged user can modify the uploaded file extension parameter to inject arbitrary JavaScript. This CVE (CVE-2019-13493) is documented across multiple sources (NVD/Red Hat/CVE listi...

CVE-2025-34510

Sitecore Experience Manager (XM) , Experience Platform (XP) , and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are vulnerable to a Zip Slip vulnerability. A remote, authenticated attacker can exploit this by sending a crafted HTTP request to upload a ZIP archive contain...

CVE-2023-26262

CVE-2023-26262 affects Sitecore XP/XM 10.3. An authenticated Sitecore user can upload language files without restrictions, enabling direct code execution on the content management (CM) server. The vulnerability stems from an unrestricted language file upload mechanism in the CMS. Impact is descri...

CVE-2016-8855

CVE-2016-8855 affects Sitecore Experience Platform 8.1 Update-3 (8.1 rev. 160519). A Cross-Site Scripting (XSS) vulnerability exists in the /sitecore/client/Applications/List Manager/Taskpages/Contact list path, exploitable via the Name or Description parameter to trigger remote attacks. The issu...

CVE-2023-27066

CVE-2023-27066 affects Sitecore Experience Platform versions 10.2 and earlier. A directory traversal vulnerability allows authenticated remote attackers (low privileges) to download arbitrary files via Urlhandle. Base CVSS v3.1: 6.5 (MEDIUM); attack vector NETWORK, authentication required LOW, pa...

CVE-2025-34511

The Sitecore PowerShell Extensions add-on for Sitecore Experience Manager (XM) and Experience Platform (XP), through version 7.0, is vulnerable to an unrestricted file upload issue. A remote, authenticated attacker can leverage crafted HTTP requests to upload arbitrary files, leading to remote co...

CVE-2023-27067

Sitecore Experience Platform (Sitecore XP) versions prior to 10.2 are affected by CVE-2023-27067. The vulnerability is a directory traversal in the download.aspx endpoint that could allow remote attackers to download arbitrary files. Impact is high on confidentiality (C:H) with no integrity or av...

CVE-2023-27068

CVE-2023-27068 affects Sitecore Experience Platform (XP) up to and including version 10.2. The issue is a deserialization of untrusted data via ValidationResult.aspx that enables remote code execution. Remediation: upgrade to Sitecore XP 10.2 or later (per PT-2023-20930). No exploitation details ...

CVE-2023-33651

CVE-2023-33651 affects Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) from 9.0 Initial Release through 13.0 Initial Release. The vulnerability is in the MVC Device Simulator and allows attackers to bypass authorization rules. The connected PT-Security rep...

CVE-2023-33653

CVE-2023-33653 affects Sitecore Experience Platform (XP) v9.3. The authenticated RCE exists in the content management component via /Applications/Content%20Manager/Execute.aspx?cmd=convert&mode=HTML. CVSS v3.1 base score 8.8 (HIGH) with network access, low privileges required, no user interaction...

CVE-2025-53693

CVE-2025-53693 is an HTML cache poisoning vulnerability in Sitecore Experience Manager (XM) and Experience Platform (XP) caused by using externally-controlled input to select classes or code (Unsafe Reflection). Affected products: XM 9.0–9.3 and 10.0–10.4; XP 9.0–9.3 and 10.0–10.4. The underlying...

CVE-2025-53694

CVE-2025-53694 is an information-disclosure vulnerability in Sitecore Experience Manager (XM) and Experience Platform (XP) affecting XM 9.2–10.4 and XP 9.2–10.4. The issue stems from exposure of sensitive information via the ItemService API, accessible under restricted anonymous conditions, enabl...

CVE-2023-33652

Sitecore Experience Platform (XP) v9.3 is affected by an authenticated remote code execution (RCE) vulnerability in the /sitecore/shell/Invoke.aspx component. The CVSS 3.1 base score is 8.8 (HIGH) with NETWORK attack vector, LOW exploit complexity, LOW privileges required, and no user interaction...

CVE-2025-53691

CVE-2025-53691 is a Sitecore vulnerability: insecure deserialization in Sitecore Experience Manager (XM) and Experience Platform (XP) can lead to Remote Code Execution (RCE). Affected: XM 9.0–9.3 and 10.0–10.4; XP 9.0–9.3 and 10.0–10.4. Root cause: untrusted data deserialization using insecure pa...