Experience Platform (Xp)
Approved changes feed: RSS · Atom
cpe:2.3:a:sitecore:experience_platform_(xp):*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Sitecore (a7d448aa-2b42-539c-981e-05d11ea00680) |
|---|---|
| Product | Experience Platform (Xp) (b091b5f4-d461-5a4a-85fb-9d2ad813ecca) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-53694 |
vulnerable | 2026-06-03 15:03:54.587460 |
Information Disclosure in ItemServices API
HIGH (7.5)
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP).This issue affects Sitecore Experience Manager (XM): from 9.2 through 10.4; Experience Platform (XP): from 9.2 through 10.4.
Published: 2025-09-03T12:36:37.520Z
Updated: 2025-09-03T13:57:58.828Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-53693 |
vulnerable | 2026-06-03 15:03:54.587040 |
HTML Cache Poisoning through Unsafe Reflections
CRITICAL (9.8)
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cache Poisoning.This issue affects Sitecore Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform (XP): from 9.0 through 9.3, from 10.0 through 10.4.
Published: 2025-09-03T12:36:53.745Z
Updated: 2025-09-03T13:53:40.699Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-53692 |
vulnerable | 2026-06-03 15:03:54.586643 |
Sitecore Experience Platform Cross-Site Scripting Vulnerability
HIGH (7.1)
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cross-Site Scripting (XSS).This issue affects Sitecore Experience Manager (XM): from 9.2 through 10.4; Experience Platform (XP): from 9.2 through 10.4.
Published: 2025-09-21T19:42:46.643Z
Updated: 2025-09-22T17:27:11.080Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-53691 |
vulnerable | 2026-06-03 15:03:54.582202 |
Sitecore Experience Remote Code Execution through Insecure Deserialization
HIGH (8.8)
Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Remote Code Execution (RCE).This issue affects Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform (XP): from 9.0 through 9.3, from 10.0 through 10.4.
Published: 2025-09-03T12:36:59.561Z
Updated: 2025-09-03T13:49:39.605Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-53690 |
vulnerable | 2026-06-03 15:03:54.578882 |
Sitecore Products ViewState Deserialization Vulnerability
CRITICAL (9)
Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.
Published: 2025-09-03T20:04:48.223Z
Updated: 2026-02-26T17:49:44.363Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-34139 |
vulnerable | 2026-06-03 15:00:43.746976 |
Sitecore XM/XP/XC and Managed Cloud 8.0 - 10.4 Arbitrary File Read
A vulnerability exists in Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud that could allow an unauthenticated attacker to read arbitrary files. This vulnerability affects all Experience Platform topologies (XM, XP, XC) from 8.0 Initial Release through 10.4 Initial Release and later. This issue affects Content Management (CM) and standalone instances. PaaS and containerized solutions are also affected.
Published: 2025-07-25T15:54:25.297Z
Updated: 2025-11-19T01:28:37.079Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-10142 |
vulnerable | 2026-06-03 14:34:38.518981 |
Sitecore XP < 8.0 and CMS < 7.2 and < 7.5 File Read via Known Path
Sitecore Experience Platform (XP) prior to 8.0 Initial Release (rev. 141212) and Content Management System (CMS) prior to 7.2 Update-3 (rev. 141226) and prior to 7.5 Update-1 (rev. 150130) contain a vulnerability that may allow an attacker to download files under the web root of the site when the name of the file is already known via a specially-crafted URL. Affected files do not include .config, .aspx or .cs files. The issue does not allow for directory browsing.
Published: 2025-07-25T15:55:07.308Z
Updated: 2026-05-15T11:14:25.020Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.