Sitecore Experience Platform (XP)

Name: Sitecore Experience Platform (XP)
Brand: Sitecore

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

critical

by severity

0critical0high0medium0low

updated 2026-10-28

vulnerabilities (7)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2025-53690US	—OT critical	60.6% (99th)	KEV	no fix	2025-09-03	≤ 0 ≤9.0
CVE-2025-53693US	—	19.9% (97th)	Exploit	no fix	2025-09-03	2 versions
CVE-2025-53694US	—	6.72% (94th)	Exploit	no fix	2025-09-03	≤ 9.2 ≤10.4
CVE-2025-53691US	—	1.64% (76th)	Exploit	no fix	2025-09-03	2 versions
CVE-2015-10142US	—	0.56% (46th)	—	8.0 Initial Release (rev. 141212)	2025-07-25	0 → 8.0 Initial Release (rev. 141212)
CVE-2025-34139US	—	0.55% (46th)	—	no fix	2025-07-25	≤ 8.0 Initial Release ≤10.4 Initial Release and later
CVE-2025-53692US	—	0.38% (32nd)	—	no fix	2025-09-21	≤ 9.2 ≤10.4

The flaw types (CWEs) most of these CVEs share.

CWE-502Deserialization of Untrusted Data2 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor1 CVEs
CWE-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')1 CVEs
CWE-522Insufficiently Protected Credentials1 CVEs
CWE-552Files or Directories Accessible to External Parties1 CVEs
CWE-610Externally Controlled Reference to a Resource in Another Sphere1 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.