Sitecore

Records40All Threatist records

Exploited (KEV)4In CISA KEV

CVSS critical7CVSS 9.0–10.0

CVSS high18CVSS 7.0–8.9

Exploited now

Sitecore records in CISA KEV

TI-2025-33607 Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability CRITICAL 98KEV 2025-09-04 TI-2019-07254 Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability CRITICAL 100KEV 2025-03-26 TI-2019-07255 Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability CRITICAL 97KEV 2025-03-26 TI-2021-18687 Sitecore XP Remote Command Execution Vulnerability CRITICAL 100KEV 2022-03-25

Components

Products in the NVD configurations · select one to filter the records

Experience Platform 21 records CRITICAL Experience Manager 11 records CRITICAL Experience Commerce 10 records CRITICAL Managed Cloud 9 records CRITICAL Cms 8 records CRITICAL Crm 2 records LOW Sitecore.net 2 records MEDIUM Rocks 1 record MEDIUM

Records

1 record in Rocks · all components

TI-2019-09283 CVE-2019-12440 · GHSA-vp9w-cxrw-6j78

The Sitecore Rocks plugin before 2.1.149 for Sitecore allows an unauthenticated threat…

MEDIUM 46

The Sitecore Rocks plugin before 2.1.149 for Sitecore allows an unauthenticated threat actor to inject malicious commands and code via the Sitecore Rocks Hard Rocks Service.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02126 Published 2019-05-29 No fix listed CWE-287

Open these records in search →

Critical	7
High	18
Medium	15
Low	0
No CVSS	0