Sploitus

15 exploited vulnerabilities in Sitecore Experience Platform

Vulnerabilities with publicly known exploits

Vendors
Microsoft, Sitecore
With known exploits
15
Affected Sitecore Experience Commerce versions
≤ 10.3, 9.0, 10.4
Affected Sitecore Experience Manager versions
≤ 10.3, 9.0, 10.4
Affected Sitecore Experience Platform versions
≤ 10.3, 10.2, 9.0, 10.4, 9.1.1, 9.3, 8.1
Affected Sitecore Managed Cloud versions
All versions

Vulnerabilities with exploits

Highest CVSS first — 9 of these already have exploit code on Sploitus

CVE-2023-35813 7 exploits
CVSS 9.8 CRITICAL 2023-06-17
Exploit for Code Injection in Sitecore Experience_CommerceSitecore - Remote Code Execution v8.2 Exploit
CVE-2023-27068
CVSS 9.8 CRITICAL 2023-05-23FIX AVAILABLE
CVE-2025-53690 2 exploits
CVSS 9.0 CRITICAL 2025-09-02FIX AVAILABLE
Exploit for Deserialization of Untrusted Data in Sitecore Experience_CommerceExploit for Deserialization of Untrusted Data in Sitecore Experience_Commerce
CVE-2025-34510 2 exploits
CVSS 9.0 HIGH 2025-02-28
📄 Sitecore XP Post-Authentication Remote Code ExecutionSitecore XP CVE-2025-34510 Post-Authentication Remote Code Execution
CVE-2019-11080 4 exploits
CVSS 9.0 HIGH 2019-06-06FIX AVAILABLE
Sitecore 8.x - Deserialization Remote Code Execution VulnerabilitySitecore 8.x - Deserialization Remote Code Execution
CVE-2025-53691 2 exploits
CVSS 8.8 HIGH 2025-08-29FIX AVAILABLE
Exploit for CVE-2025-53691Exploit for CVE-2025-53691
CVE-2023-33653
CVSS 8.8 HIGH 2023-06-06FIX AVAILABLE
CVE-2023-33652
CVSS 8.8 HIGH 2023-06-06
CVE-2025-34509 5 exploits
CVSS 8.5 HIGH 2025-02-28
📄 Sitecore Experience Manager / Experience Platform 10.1 Shell Upload / Hardcoded Credentials📄 Sitecore XP Post-Authentication File Upload
CVE-2025-53694 2 exploits
CVSS 7.5 HIGH 2025-08-29FIX AVAILABLE
Exploit for CVE-2025-53694Exploit for CVE-2025-53691
CVE-2023-33651
CVSS 7.5 HIGH 2023-06-06FIX AVAILABLE
CVE-2023-27067
CVSS 7.5 HIGH 2023-05-22FIX AVAILABLE
CVE-2023-27066
CVSS 6.5 MEDIUM 2023-05-22
CVE-2016-8855 5 exploits
CVSS 6.1 MEDIUM 2017-03-19FIX AVAILABLE
Sitecore Experience Platform 8.1 Update-3 Cross Site Scripting VulnerabilitySitecore CMS 8.1 Update-3 - Cross-Site Scripting Vulnerability
CVE-2025-27218 4 exploits
CVSS 5.3 MEDIUM 2025-01-06FIX AVAILABLE
📄 Sitecore 10.4 Remote Code ExecutionSitecore 10.4 - Remote Code Execution (RCE)