Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

9 records

Vendor: Sitecore Component: Managed Cloud Clear all filters
TI-2025-33607 CVE-2025-53690 · GHSA-g5r9-cgwv-wmpc

Sitecore Products ViewState Deserialization Vulnerability

Priority CRITICAL 98KEV

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (X…

CVSS 3.1CRITICAL 9.0 Network No auth No interaction EPSS 0.6071 Published 2025-09-03 No fix listed CWE-502
TI-2025-33608 CVE-2025-53691 · GHSA-cpg3-c796-vg5v

Sitecore Experience Remote Code Execution through Insecure Deserialization

Priority HIGH 73

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Remote Code Execution (RCE).This issue affects Experience Manager (XM): from 9.0 through 9.3,…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01636 Published 2025-09-03 No fix listed CWE-502
TI-2025-33610 CVE-2025-53693 · GHSA-6jj2-mfwj-34q5

HTML Cache Poisoning through Unsafe Reflections

Priority HIGH 82

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cache Poisoning.This issue affects S…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.20307 Published 2025-09-03 No fix listed CWE-470
TI-2025-33611 CVE-2025-53694 · GHSA-vmj4-jxq2-r8rx

Information Disclosure in ItemServices API

Priority HIGH 72

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP).This issue affects Sitecore Experience Manager (XM): from 9.2 throu…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.06854 Published 2025-09-03 No fix listed CWE-200
TI-2025-24535 CVE-2025-34511 · GHSA-74ph-965p-2jc2

Sitecore PowerShell Extension RCE via Unrestricted Upload

Priority HIGH 73

Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), through version 7.0 is vulnerable to an unrestricted file upload issue.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.30446 Published 2025-06-17 No fix listed CWE-434
TI-2025-24534 CVE-2025-34510 · GHSA-mh69-97fr-wj66

Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip

Priority HIGH 73

Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.24835 Published 2025-06-17 No fix listed CWE-23
TI-2025-24533 CVE-2025-34509 · GHSA-g93f-92gj-4q4x

Sitecore XM and XP Hardcoded Credentials

Priority HIGH 74

Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.55874 Published 2025-06-17 Fixed in 10.4.1 rev. 011941 PRE, 10.3.3 rev. 011967 PRE +1 CWE-798