Sitecore Experience Platform vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Sitecore Experience Platform: 3 record(s), with affected versions and fixes.
cpe:2.3:a:sitecore:experience_platform

CVE-2025-53690 Critical · 9.0 KEV High · 66 Public exploit CWE-502 Sep 3, 2025

Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.

CVE-2021-42237 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-502 Nov 5, 2021

Sitecore XP Remote Command Execution Vulnerability

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.

CVE-2019-9874 Critical · 9.8 KEV High · 67 Public exploit CWE-502 May 31, 2019

Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability

Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.