CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Sitecore Experience Manager and Experience Platform Remote Code Execution Vulnerability (CVE-2025-53690) Security Advisory
[Affected Scope] Sitecore Experience Manager (XM) and Experience Platform (XP) versions up to and including 9.0
[Impact] Unauthenticated remote attackers can execute arbitrary code and fully compromise the host system via deserialization of untrusted data
[Mitigation] Immediately apply the official security patches from the vendor, or implement temporary workarounds such as enforcing ViewState encryption and restricting access
Sitecore Experience Platform (XP) Insecure Deserialization Remote Code Execution (RCE) Vulnerability Advisory (CVE-2021-42237)
[Affected Scope] Sitecore Experience Platform (XP) 7.5 Initial Release to Sitecore XP 8.2 Update-7.
[Impact] Unauthenticated remote attackers can execute arbitrary commands with system privileges on the hosting server by sending specially crafted serialized payloads.
[Mitigation] Apply official security patches immediately or restrict external access to the vulnerable '/sitecore/shell/ClientBin/Reporting/ReportService.asmx' endpoint.
Sitecore CMS and XP AntiCSRF Module Deserialization Remote Code Execution (RCE) (CVE-2019-9874)
[Affected Scope] Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2
[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by sending a malicious serialized .NET object in the __CSRFTOKEN HTTP POST parameter
[Mitigation] Apply official security patches, disable the vulnerable AntiCSRF module, or upgrade to a supported secure version