Read the docs

Sitecore

Records40All Threatist records
Exploited (KEV)4In CISA KEV
CVSS critical7CVSS 9.0–10.0
CVSS high18CVSS 7.0–8.9

Exploited now

Sitecore records in CISA KEV
TI-2025-33607 Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability Priority CRITICAL 98KEV 2025-09-04TI-2019-07254 Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability Priority CRITICAL 100KEV 2025-03-26TI-2019-07255 Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability Priority CRITICAL 97KEV 2025-03-26TI-2021-18687 Sitecore XP Remote Command Execution Vulnerability Priority CRITICAL 100KEV 2022-03-25

Components

Products in the NVD configurations · select one to filter the records
Experience Platform 21 records CRITICAL Experience Manager 11 records CRITICAL Experience Commerce 10 records CRITICAL Managed Cloud 9 records CRITICAL Cms 8 records CRITICAL Crm 2 records LOW Sitecore.net 2 records MEDIUM Rocks 1 record MEDIUM

Records

8 records in Cms · all components

TI-2019-07254 CVE-2019-9874 · GHSA-wfwm-vf76-3692

Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF)…

Priority CRITICAL 100KEV

Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a s…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.83736 Published 2019-05-31 No fix listed CWE-502
TI-2017-08462 CVE-2017-11440 · GHSA-4vgr-mpfq-v32m

In Sitecore 8.2, there is absolute path traversal via the…

Priority LOW 26

In Sitecore 8.2, there is absolute path traversal via the shell/Applications/Layouts/IDE.aspx fi parameter and the admin/LinqScratchPad.aspx Reference parameter.

CVSS 3.0MEDIUM 4.9 Network High privileges No interaction EPSS 0.02033 Published 2017-07-19 No fix listed CWE-22
Open these records in search →