Vulnerabilidades de Sitecore
CVEs publicadas que afetam produtos de Sitecore: 4 registro(s), com severidade, exploração e correções.
Experience Platform 3Cms 2Experience Commerce 1Experience Manager 1Managed Cloud 1Experience Manager (XM) 1Experience Platform (XP) 1
CVE-2025-53690
Crítica · 9.0
KEV Alta · 66 Exploit público CWE-502 03/09/2025
Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability
Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.
CVE-2021-42237
Crítica · 9.8
KEV Urgente · 93 Exploit público Ransomware CWE-502 05/11/2021
Sitecore XP Remote Command Execution Vulnerability
Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.
CVE-2019-9874
Crítica · 9.8
KEV Alta · 67 Exploit público CWE-502 31/05/2019
Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
CVE-2019-9875
Alta · 8.8
KEV Alta · 55 CWE-502 31/05/2019
Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter.