Updated 24 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

36added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

41 results

Sep 21, 2025Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Sitecore Sitecore Experience Manager (XM), SitecoreCVE-2025-53692 · Other software · Sitecore · reported by 9947ef80-c5d5-474a-bbab-97341a59000eHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cross-Site Scripting (XSS).This issue affects Sitecore Experience Manager (XM): from 9.2 through 10.4; Experience Platform (XP): from 9.2 through 10.4.
Product
Sitecore Experience Manager (XM)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chudypb.github.io labs.watchtowr.com
Sep 3, 2025Sitecore Multiple Products Deserialization of Untrusted Data VulnerabilityCVE-2025-53690 · Other software · Sitecore · reported by 9947ef80-c5d5-474a-bbab-97341a59000eExploitedCritical 9
Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution.
Product
Multiple Products
On CISA’s list since
Sep 4, 2025 (federal fix deadline Sep 25, 2025)
What to do
Attackers are using this now. Install Sitecore’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog cloud.google.com support.sitecore.com
Sep 3, 2025Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP).This isCVE-2025-53694 · Other software · Sitecore · reported by 9947ef80-c5d5-474a-bbab-97341a59000eHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP).This issue affects Sitecore Experience Manager (XM): from 9.2 through 10.4; Experience Platform (XP): from 9.2 through 10.4.
Product
Sitecore Experience Manager (XM)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record labs.watchtowr.com support.sitecore.com
Sep 3, 2025Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore ExperienCVE-2025-53693 · Other software · Sitecore · reported by 9947ef80-c5d5-474a-bbab-97341a59000eCritical 9.8
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cache Poisoning.This issue affects Sitecore Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform (XP): from 9.0 through 9.3, from 10.0 through 10.4.
Product
Sitecore Experience Manager (XM)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record labs.watchtowr.com support.sitecore.com
Sep 3, 2025Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Remote Code Execution (RCE).This iCVE-2025-53691 · Other software · Sitecore · reported by 9947ef80-c5d5-474a-bbab-97341a59000eHigh 8.8
Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Remote Code Execution (RCE).This issue affects Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform (XP): from 9.0 through 9.3, from 10.0 through 10.4.
Product
Experience Manager (XM)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record labs.watchtowr.com support.sitecore.com
Jul 25, 2025A vulnerability exists in Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud that could allow an unauthentiCVE-2025-34139 · Other software · Sitecore · reported by VulnCheckHigh 8.7
A vulnerability exists in Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud that could allow an unauthenticated attacker to read arbitrary files. This vulnerability affects all Experience Platform topologies (XM, XP, XC) from 8.0 Initial Release through 10.4 Initial Release and later. This issue affects Content Management (CM) and standalone instances. PaaS and containerized solutions are also affected.
Product
Experience Manager (XM)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.sitecore.com support.sitecore.com
Jul 25, 2025A cross-site scripting (XSS) vulnerability exists in Sitecore Experience Platform (XP) 7.5 - 10.2 and CMS 7.2 - 7.2 Update-6 that may allow authenticated SitecoCVE-2022-4979 · Other software · Sitecore · reported by VulnCheckMedium 5.1
A cross-site scripting (XSS) vulnerability exists in Sitecore Experience Platform (XP) 7.5 - 10.2 and CMS 7.2 - 7.2 Update-6 that may allow authenticated Sitecore Shell users to be tricked into executing custom JS code. Managed Cloud Standard customers who run the affected Sitecore Experience Platform / CMS versions are also affected.
Product
Experience Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.sitecore.com support.sitecore.com
Jul 25, 2025An information disclosure vulnerability exits in Sitecore JSS React Sample Application 11.0.0 - 14.0.1 that may cause page content intended for one user to be sCVE-2020-36850 · Other software · Sitecore · reported by VulnCheckHigh 8.7
An information disclosure vulnerability exits in Sitecore JSS React Sample Application 11.0.0 - 14.0.1 that may cause page content intended for one user to be shown to another user.
Product
JSS React Sample Application
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.sitecore.com support.sitecore.com
Jul 25, 2025Sitecore Experience Platform (XP) prior to 8.0 Initial Release (rev.CVE-2015-10142 · Other software · Sitecore · reported by VulnCheckMedium 6.9
Sitecore Experience Platform (XP) prior to 8.0 Initial Release (rev. 141212) and Content Management System (CMS) prior to 7.2 Update-3 (rev. 141226) and prior to 7.5 Update-1 (rev. 150130) contain a vulnerability that may allow an attacker to download files under the web root of the site when the name of the file is already known via a specially-crafted URL. Affected files do not include .config, .aspx or .cs files. The issue does not allow for directory browsing.
Product
Experience Platform (XP)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.sitecore.com support.sitecore.com
Jun 17, 2025Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), through version 7.0 is vulnerable to an unrestrictedCVE-2025-34511 · Other software · Sitecore · reported by VulnCheckHigh 8.8
Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), through version 7.0 is vulnerable to an unrestricted file upload issue. A remote, authenticated attacker can upload arbitrary files to the server using crafted HTTP requests, resulting in remote code execution.
Product
Powershell Extension
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record labs.watchtowr.com support.sitecore.com
Jun 17, 2025Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip SlCVE-2025-34510 · Other software · Sitecore · reported by VulnCheckHigh 8.8
Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability. A remote, authenticated attacker can exploit this issue by sending a crafted HTTP request to upload a ZIP archive containing path traversal sequences, allowing arbitrary file writes and leading to code execution.
Product
Experience Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record labs.watchtowr.com support.sitecore.com
Jun 17, 2025Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev.CVE-2025-34509 · Other software · Sitecore · reported by VulnCheckHigh 7.5
Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access administrative API over HTTP.
Product
Experience Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record labs.watchtowr.com support.sitecore.com
Feb 20, 2025Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserialization.CVE-2025-27218 · Other software · reported by MITREMedium 5.3
Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserialization.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.sitecore.com
Sep 15, 2024An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0 Initial Release through 10.4 Initial RelCVE-2024-46938 · Other software · sitecore · reported by MITREHigh 7.5
An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0 Initial Release through 10.4 Initial Release. An unauthenticated attacker can read arbitrary files.
Product
experience_platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.sitecore.com
Jun 17, 2023Multiple Sitecore products allow remote code execution.CVE-2023-35813 · Websites & servers · Sitecore · reported by MITRECritical 9.8
Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce through 10.3.
Product
Experience Commerce
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.sitecore.com support.sitecore.com
Jun 6, 2023Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /Applications/ContCVE-2023-33653 · Other software · Sitecore · reported by MITREHigh 8.8
Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /Applications/Content%20Manager/Execute.aspx?cmd=convert&mode=HTML.
Product
Experience Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.assetnote.io blog.assetnote.io
Jun 6, 2023Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /sitecore/shell/InCVE-2023-33652 · Other software · Sitecore · reported by MITREHigh 8.8
Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /sitecore/shell/Invoke.aspx.
Product
Experience Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.assetnote.io blog.assetnote.io
Jun 6, 2023An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initial Release to v13.0 ICVE-2023-33651 · Websites & servers · Sitecore · reported by MITREHigh 7.5
An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initial Release to v13.0 Initial Release allows attackers to bypass authorization rules.
Product
Experience Commerce
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.assetnote.io support.sitecore.com
May 22, 2023Deserialization of Untrusted Data in Sitecore Experience Platform through 10.2 allows remote attackers to run arbitrary code via ValidationResult.aspx.CVE-2023-27068 · Other software · Sitecore · reported by MITRECritical 9.8
Deserialization of Untrusted Data in Sitecore Experience Platform through 10.2 allows remote attackers to run arbitrary code via ValidationResult.aspx.
Product
Experience Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blogs.night-wolf.io dev.sitecore.net
May 22, 2023Directory Traversal vulnerability in Sitecore Experience Platform through 10.2 allows remote attackers to download arbitrary files via crafted command to downloCVE-2023-27067 · Other software · Sitecore · reported by MITREHigh 7.5
Directory Traversal vulnerability in Sitecore Experience Platform through 10.2 allows remote attackers to download arbitrary files via crafted command to download.aspx
Product
Experience Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blogs.night-wolf.io dev.sitecore.net
May 22, 2023Directory Traversal vulnerability in Site Core Experience Platform 10.2 and earlier allows authenticated remote attackers to download arbitrary files via UrlhanCVE-2023-27066 · Other software · Sitecore · reported by MITREMedium 6.5
Directory Traversal vulnerability in Site Core Experience Platform 10.2 and earlier allows authenticated remote attackers to download arbitrary files via Urlhandle.
Product
Experience Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blogs.night-wolf.io dev.sitecore.net
Mar 14, 2023An issue was discovered in Sitecore XP/XM 10.3.CVE-2023-26262 · Other software · Sitecore · reported by MITREHigh 7.2
An issue was discovered in Sitecore XP/XM 10.3. As an authenticated Sitecore user, a unrestricted language file upload vulnerability exists the can lead to direct code execution on the content management (CM) server.
Product
Experience Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com sitecore.com
Nov 5, 2021Sitecore XP Remote Command Execution VulnerabilityCVE-2021-42237 · Other software · Sitecore · reported by MITREExploitedRansomwareCritical 9.8
Sitcore XP contains an insecure deserialization vulnerability which can allow for remote code execution.
Product
XP
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Sitecore’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com blog.assetnote.io
Aug 12, 2021Sitecore through 10.1, when Update Center is enabled, allows remote authenticated users to upload arbitrary files and achieve remote code execution by visiting CVE-2021-38366 · Other software · Sitecore · reported by MITREHigh 8.8
Sitecore through 10.1, when Update Center is enabled, allows remote authenticated users to upload arbitrary files and achieve remote code execution by visiting an uploaded .aspx file at an admin/Packages URL.
Product
Sitecore
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.istern.dk blog.istern.dk
Aug 5, 2019Multiple cross-site scripting (XSS) vulnerabilities in Sitecore CMS 9.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) CVE-2019-11198 · Other software · Sitecore · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in Sitecore CMS 9.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) #300583 - List Manager Dashboard module, (2) #307638 - Campaign Creator module, (3) #316994 - Attributes field, (4) I#316995 - Icon Selection module, (5) #317000 - Latitude field, (6) #317000 - Longitude field, (7) #317017 - UploadPackage2.aspx module, (8) #317072 - Context menu, or (9) I#317073 - Insert from Template dialog.
Product
CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dev.sitecore.net outpost24.com
Jul 17, 2019In Sitecore 9.0 rev 171002, Persistent XSS exists in the Media Library and File Manager.CVE-2019-13493 · Other software · Sitecore · reported by MITREMedium 5.4
In Sitecore 9.0 rev 171002, Persistent XSS exists in the Media Library and File Manager. An authenticated unprivileged user can modify the uploaded file extension parameter to inject arbitrary JavaScript.
Product
Experience Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Jun 6, 2019Sitecore Experience Platform (XP) prior to 9.1.1 is vulnerable to remote code execution via deserialization, aka TFS # 293863.CVE-2019-11080 · Other software · Sitecore · reported by MITREHigh 8.8
Sitecore Experience Platform (XP) prior to 9.1.1 is vulnerable to remote code execution via deserialization, aka TFS # 293863. An authenticated user with necessary permissions is able to remotely execute OS commands by sending a crafted serialized object.
Product
Experience Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com dev.sitecore.net
May 31, 2019Sitecore CMS and Experience Platform (XP) Deserialization VulnerabilityCVE-2019-9875 · Other software · Sitecore · reported by MITREExploitedHigh 8.8
Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
Product
CMS and Experience Platform (XP)
On CISA’s list since
Mar 26, 2025 (federal fix deadline Apr 16, 2025)
What to do
Attackers are using this now. Install Sitecore’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog dev.sitecore.net synacktiv.com
May 31, 2019Sitecore CMS and Experience Platform (XP) Deserialization VulnerabilityCVE-2019-9874 · Other software · Sitecore · reported by MITREExploitedCritical 9.8
Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
Product
CMS and Experience Platform (XP)
On CISA’s list since
Mar 26, 2025 (federal fix deadline Apr 16, 2025)
What to do
Attackers are using this now. Install Sitecore’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog dev.sitecore.net synacktiv.com
May 29, 2019The Sitecore Rocks plugin before 2.1.149 for Sitecore allows an unauthenticated threat actor to inject malicious commands and code via the Sitecore Rocks Hard RCVE-2019-12440 · Other software · Sitecore · reported by MITRECritical 9.8
The Sitecore Rocks plugin before 2.1.149 for Sitecore allows an unauthenticated threat actor to inject malicious commands and code via the Sitecore Rocks Hard Rocks Service.
Product
Rocks
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 27, 2018An issue was discovered in Sitecore Sitecore.NET 8.1 rev.CVE-2018-7669 · Other software · Sitecore · reported by MITREHigh 7.5
An issue was discovered in Sitecore Sitecore.NET 8.1 rev. 151207 Hotfix 141178-1 and above. The 'Log Viewer' application is vulnerable to a directory traversal attack, allowing an attacker to access arbitrary files from the host Operating System using a sitecore/shell/default.aspx?xmlcontrol=LogViewerDetails&file= URI. Validation is performed to ensure that the text passed to the 'file' parameter correlates to the correct log file directory. This filter can be bypassed by including a valid log filename and then appending a traditional 'dot dot' style attack.
Product
Sitecore.net
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org kb.sitecore.net
Jul 19, 2017In Sitecore 8.2, there is absolute path traversal via the shell/Applications/Layouts/IDE.aspx fi parameter and the admin/LinqScratchPad.aspx Reference parameterCVE-2017-11440 · Other software · Sitecore · reported by MITREMedium 4.9
In Sitecore 8.2, there is absolute path traversal via the shell/Applications/Layouts/IDE.aspx fi parameter and the admin/LinqScratchPad.aspx Reference parameter.
Product
CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com xc0re.net
Jul 19, 2017In Sitecore 8.2, there is reflected XSS in the shell/Applications/Tools/Run Program parameter.CVE-2017-11439 · Other software · Sitecore · reported by MITREMedium 5.4
In Sitecore 8.2, there is reflected XSS in the shell/Applications/Tools/Run Program parameter.
Product
CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com xc0re.net
Jun 23, 2017Sitecore.NET 7.1 through 7.2 has a Cross Site Scripting Vulnerability via the searchStr parameter to the /Search-Results URI.CVE-2017-9356 · Other software · Sitecore · reported by MITREMedium 6.1
Sitecore.NET 7.1 through 7.2 has a Cross Site Scripting Vulnerability via the searchStr parameter to the /Search-Results URI.
Product
Sitecore.net
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org securityfocus.com
May 23, 2017Sitecore CRM 8.1 Rev 151207 allows remote authenticated administrators to read arbitrary files via an absolute path traversal attack on sitecore/shell/download.CVE-2017-5966 · Other software · Sitecore · reported by MITREMedium 4.9
Sitecore CRM 8.1 Rev 151207 allows remote authenticated administrators to read arbitrary files via an absolute path traversal attack on sitecore/shell/download.aspx with the file parameter.
Product
CRM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record research.aurainfosec.io research.aurainfosec.io
May 23, 2017The package manager in Sitecore CRM 8.1 Rev 151207 allows remote authenticated administrators to execute arbitrary ASP code by creating a ZIP archive in which aCVE-2017-5965 · Other software · Sitecore · reported by MITREMedium 6.7
The package manager in Sitecore CRM 8.1 Rev 151207 allows remote authenticated administrators to execute arbitrary ASP code by creating a ZIP archive in which a .asp file has a ..\ in its pathname, visiting sitecore/shell/applications/install/dialogs/Upload%20Package/UploadPackage2.aspx to upload this archive and extract its contents, and visiting a URI under sitecore/ to execute the .asp file.
Product
CRM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record research.aurainfosec.io research.aurainfosec.io
Mar 19, 2017Cross-Site Scripting (XSS) in "/sitecore/client/Applications/List Manager/Taskpages/Contact list" in Sitecore Experience Platform 8.1 rev.CVE-2016-8855 · Other software · Sitecore · reported by MITREMedium 6.1
Cross-Site Scripting (XSS) in "/sitecore/client/Applications/List Manager/Taskpages/Contact list" in Sitecore Experience Platform 8.1 rev. 160519 (8.1 Update-3) allows remote attacks via the Name or Description parameter. This is fixed in 8.2 Update-2.
Product
Experience Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Jan 13, 2015Cross-site scripting (XSS) vulnerability in Sitecore CMS before 7.0 Update-4 (rev.CVE-2014-100004 · Other software · Sitecore · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Sitecore CMS before 7.0 Update-4 (rev. 140120) allows remote attackers to inject arbitrary web script or HTML via the xmlcontrol parameter to the default URI. NOTE: some of these details are obtained from third party information.
Product
CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Dec 21, 2009The Staging Webservice ("sitecore modules/staging/service/api.asmx") in Sitecore Staging Module 5.4.0 rev.080625 and earlier allows remote attackers to bypass aCVE-2009-4367 · Other software · Sitecore · reported by MITREMedium 6.8
The Staging Webservice ("sitecore modules/staging/service/api.asmx") in Sitecore Staging Module 5.4.0 rev.080625 and earlier allows remote attackers to bypass authentication and (1) upload files, (2) download files, (3) list directories, and (4) clear the server cache via crafted SOAP requests with arbitrary Username and Password values, possibly related to a direct request.
Product
Staging Module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Jun 22, 2009Cross-site scripting (XSS) vulnerability in login/default.aspx in Sitecore CMS before 6.0.2 Update-1 090507 allows remote attackers to inject arbitrary web scriCVE-2009-2163 · Other software · Sitecore · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in login/default.aspx in Sitecore CMS before 6.0.2 Update-1 090507 allows remote attackers to inject arbitrary web script or HTML via the sc_error parameter.
Product
CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.intern0t.net secunia.com
Mar 24, 2009Unspecified vulnerability in the web service in Sitecore CMS 5.3.1 rev.CVE-2009-1055 · Other software · Sitecore · reported by MITREMedium 4
Unspecified vulnerability in the web service in Sitecore CMS 5.3.1 rev. 071114 allows remote authenticated users to gain access to security databases, and obtain administrative and user credentials, via unknown vectors related to SOAP and XML requests.
Product
CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sdn5.sitecore.net secunia.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.