Skip to content
Noroxi

Sitecore records

35 published records for vendor sitecore.

Researcher profile

Entered KEV
4 · 11.4%
Weaponized
6 · 17.1%
Pre-auth RCE
5
With a fix record
2.9%
Median publish → KEV
1133 days

Records by year

  1. 17
  2. 18
  3. 19
  4. 21
  5. 23
  6. 24
  7. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

35 records
  • CVE-2021-42237
    98Now

    Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achi

    CriticalCVSS 9.8KEVWeaponizedEPSS 98%

    sitecore · experience platformNov 5, 2021

  • CVE-2019-9874
    94Now

    Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to

    CriticalCVSS 9.8KEVWeaponizedEPSS 84%

    sitecore · cmsMay 31, 2019

  • CVE-2025-53690
    81Now

    Sitecore Products ViewState Deserialization Vulnerability

    CriticalCVSS 9.0KEVWeaponizedEPSS 51%

    sitecore · experience commerceSep 3, 2025

  • CVE-2019-9875
    69This week

    Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code

    HighCVSS 8.8KEVWeaponizedEPSS 14%

    sitecore · cmsMay 31, 2019

  • CVE-2023-35813
    65This week

    Multiple Sitecore products allow remote code execution.

    CriticalCVSS 9.8Proof of conceptEPSS 87%

    sitecore · experience commerceJun 17, 2023

  • CVE-2025-34509
    47Plan

    Sitecore XM and XP Hardcoded Credentials

    HighCVSS 7.5Proof of conceptEPSS 56%

    sitecore · experience commerceJun 17, 2025

  • CVE-2024-46938
    44Plan

    An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0 Initial Release thro

    HighCVSS 7.5Proof of conceptEPSS 47%

    sitecore · experience commerceSep 15, 2024

  • CVE-2025-34511
    44Plan

    Sitecore PowerShell Extension RCE via Unrestricted Upload

    HighCVSS 8.8WeaponizedEPSS 30%

    sitecore · experience commerceJun 17, 2025

  • CVE-2025-53693
    43Plan

    HTML Cache Poisoning through Unsafe Reflections

    CriticalCVSS 9.8Proof of conceptEPSS 15%

    sitecore · experience commerceSep 3, 2025

  • CVE-2025-34510
    42Plan

    Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip

    HighCVSS 8.8WeaponizedEPSS 24%

    sitecore · experience commerceJun 17, 2025

  • CVE-2019-12440
    40Plan

    The Sitecore Rocks plugin before 2.1.149 for Sitecore allows an unauthenticated threat actor to inject malicious commands and code via the S

    CriticalCVSS 9.8No exploitEPSS 2%

    sitecore · rocksMay 29, 2019

  • CVE-2023-27068
    40Plan

    Deserialization of Untrusted Data in Sitecore Experience Platform through 10.2 allows remote attackers to run arbitrary code via ValidationR

    CriticalCVSS 9.8No exploitEPSS 2%

    sitecore · experience platformMay 22, 2023

  • CVE-2019-11080
    39Monitor

    Sitecore Experience Platform (XP) prior to 9.1.1 is vulnerable to remote code execution via deserialization, aka TFS # 293863.

    HighCVSS 8.8Proof of conceptEPSS 14%

    sitecore · experience platformJun 6, 2019

  • CVE-2021-38366
    36Monitor

    Sitecore through 10.1, when Update Center is enabled, allows remote authenticated users to upload arbitrary files and achieve remote code ex

    HighCVSS 8.8No exploitEPSS 3%

    sitecore · sitecoreAug 12, 2021

  • CVE-2023-33652
    36Monitor

    Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the componen

    HighCVSS 8.8No exploitEPSS 2%

    sitecore · experience platformJun 6, 2023

  • CVE-2023-33653
    36Monitor

    Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the componen

    HighCVSS 8.8No exploitEPSS 2%

    sitecore · experience platformJun 6, 2023

  • CVE-2018-7669
    35Monitor

    An issue was discovered in Sitecore Sitecore.NET 8.1 rev.

    HighCVSS 7.5Proof of conceptEPSS 17%

    sitecore · sitecore.netApr 27, 2018

  • CVE-2025-53691
    35Monitor

    Sitecore Experience Remote Code Execution through Insecure Deserialization

    HighCVSS 8.8Proof of conceptEPSS 2%

    sitecore · experience commerceSep 3, 2025

  • CVE-2025-53694
    32Monitor

    Information Disclosure in ItemServices API

    HighCVSS 7.5Proof of conceptEPSS 6%

    sitecore · experience commerceSep 3, 2025

  • CVE-2023-27067
    30Monitor

    Directory Traversal vulnerability in Sitecore Experience Platform through 10.2 allows remote attackers to download arbitrary files via craft

    HighCVSS 7.5No exploitEPSS 2%

    sitecore · experience platformMay 22, 2023

  • CVE-2023-33651
    30Monitor

    An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initia

    HighCVSS 7.5No exploitEPSS 1%

    sitecore · experience commerceJun 6, 2023

  • CVE-2009-4367
    29Monitor

    The Staging Webservice ("sitecore modules/staging/service/api.asmx") in Sitecore Staging Module 5.4.0 rev.080625 and earlier allows remote a

    MediumCVSS 6.8Proof of conceptEPSS 6%

    sitecore · staging moduleDec 21, 2009

  • CVE-2023-26262
    28Monitor

    An issue was discovered in Sitecore XP/XM 10.3.

    HighCVSS 7.2Proof of conceptEPSS 2%

    sitecore · experience managerMar 14, 2023

  • CVE-2023-27066
    26Monitor

    Directory Traversal vulnerability in Site Core Experience Platform 10.2 and earlier allows authenticated remote attackers to download arbitr

    MediumCVSS 6.5No exploitEPSS 1%

    sitecore · experience platformMay 22, 2023

  • CVE-2017-5965
    26Monitor

    The package manager in Sitecore CRM 8.1 Rev 151207 allows remote authenticated administrators to execute arbitrary ASP code by creating a ZI

    MediumCVSS 6.7No exploitEPSS 1%

    sitecore · crmMay 23, 2017