Read the docs

Sitecore

Records40All Threatist records
Exploited (KEV)4In CISA KEV
CVSS critical7CVSS 9.0–10.0
CVSS high18CVSS 7.0–8.9

Exploited now

Sitecore records in CISA KEV
TI-2025-33607 Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability Priority CRITICAL 98KEV 2025-09-04TI-2019-07254 Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability Priority CRITICAL 100KEV 2025-03-26TI-2019-07255 Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability Priority CRITICAL 97KEV 2025-03-26TI-2021-18687 Sitecore XP Remote Command Execution Vulnerability Priority CRITICAL 100KEV 2022-03-25

Components

Products in the NVD configurations · select one to filter the records
Experience Platform 21 records CRITICAL Experience Manager 11 records CRITICAL Experience Commerce 10 records CRITICAL Managed Cloud 9 records CRITICAL Cms 8 records CRITICAL Crm 2 records LOW Sitecore.net 2 records MEDIUM Rocks 1 record MEDIUM

Records

2 records in Crm · all components

TI-2017-03880 CVE-2017-5965 · GHSA-889m-9374-3cr2

The package manager in Sitecore CRM 8.1 Rev 151207 allows remote authenticated…

Priority LOW 32

The package manager in Sitecore CRM 8.1 Rev 151207 allows remote authenticated administrators to execute arbitrary ASP code by creating a ZIP archive in which a .asp file has a ..\ in its pathname, visiting sitecore/shel…

CVSS 3.0MEDIUM 6.7 Local High privileges No interaction EPSS 0.01047 Published 2017-05-23 No fix listed
Open these records in search →