CMS
by Sitecore
CVEs (14)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-5965 | Med | 0.44 | 6.7 | 0.01 | May 23, 2017 | The package manager in Sitecore CRM 8.1 Rev 151207 allows remote authenticated administrators to execute arbitrary ASP code by creating a ZIP archive in which a .asp file has a ..\ in its pathname, visiting sitecore/shell/applications/install/dialogs/Upload%20Package/UploadPackag… | ||
| CVE-2017-11439 | Med | 0.35 | 5.4 | 0.01 | Jul 19, 2017 | In Sitecore 8.2, there is reflected XSS in the shell/Applications/Tools/Run Program parameter. | ||
| CVE-2022-4979 | Med | 0.33 | — | 0.01 | Jul 25, 2025 | A cross-site scripting (XSS) vulnerability exists in Sitecore Experience Platform (XP) 7.5 - 10.2 and CMS 7.2 - 7.2 Update-6 that may allow authenticated Sitecore Shell users to be tricked into executing custom JS code. Managed Cloud Standard customers who run the affected… | ||
| CVE-2017-11440 | Med | 0.32 | 4.9 | 0.02 | Jul 19, 2017 | In Sitecore 8.2, there is absolute path traversal via the shell/Applications/Layouts/IDE.aspx fi parameter and the admin/LinqScratchPad.aspx Reference parameter. | ||
| CVE-2017-5966 | Med | 0.32 | 4.9 | 0.02 | May 23, 2017 | Sitecore CRM 8.1 Rev 151207 allows remote authenticated administrators to read arbitrary files via an absolute path traversal attack on sitecore/shell/download.aspx with the file parameter. | ||
| CVE-2019-9874 | 0.19 | — | 0.84 | KEV | May 31, 2019 | Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter… | ||
| CVE-2019-13493 | 0.03 | — | 0.02 | Jul 17, 2019 | In Sitecore 9.0 rev 171002, Persistent XSS exists in the Media Library and File Manager. An authenticated unprivileged user can modify the uploaded file extension parameter to inject arbitrary JavaScript. | |||
| CVE-2009-2163 | 0.03 | — | 0.03 | Jun 22, 2009 | Cross-site scripting (XSS) vulnerability in login/default.aspx in Sitecore CMS before 6.0.2 Update-1 090507 allows remote attackers to inject arbitrary web script or HTML via the sc_error parameter. | |||
| CVE-2021-38366 | 0.00 | — | 0.03 | Aug 12, 2021 | Sitecore through 10.1, when Update Center is enabled, allows remote authenticated users to upload arbitrary files and achieve remote code execution by visiting an uploaded .aspx file at an admin/Packages URL. | |||
| CVE-2020-13427 | 0.00 | — | 0.01 | Jun 22, 2020 | Victor CMS 1.0 has Persistent XSS in admin/users.php?source=add_user via the user_name, user_firstname, or user_lastname parameter. | |||
| CVE-2019-11198 | 0.00 | — | 0.01 | Aug 5, 2019 | Multiple cross-site scripting (XSS) vulnerabilities in Sitecore CMS 9.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) #300583 - List Manager Dashboard module, (2) #307638 - Campaign Creator module, (3) #316994 - Attributes field, (4)… | |||
| CVE-2019-10238 | 0.00 | — | 0.01 | Mar 27, 2019 | Sitemagic CMS v4.4 has XSS in SMFiles/FrmUpload.class.php via the filename parameter. | |||
| CVE-2014-100004 | 0.00 | — | 0.02 | Jan 13, 2015 | Cross-site scripting (XSS) vulnerability in Sitecore CMS before 7.0 Update-4 (rev. 140120) allows remote attackers to inject arbitrary web script or HTML via the xmlcontrol parameter to the default URI. NOTE: some of these details are obtained from third party information. | |||
| CVE-2009-1055 | 0.00 | — | 0.01 | Mar 24, 2009 | Unspecified vulnerability in the web service in Sitecore CMS 5.3.1 rev. 071114 allows remote authenticated users to gain access to security databases, and obtain administrative and user credentials, via unknown vectors related to SOAP and XML requests. |
- risk 0.44cvss 6.7epss 0.01
The package manager in Sitecore CRM 8.1 Rev 151207 allows remote authenticated administrators to execute arbitrary ASP code by creating a ZIP archive in which a .asp file has a ..\ in its pathname, visiting sitecore/shell/applications/install/dialogs/Upload%20Package/UploadPackag…
- risk 0.35cvss 5.4epss 0.01
In Sitecore 8.2, there is reflected XSS in the shell/Applications/Tools/Run Program parameter.
- risk 0.33cvss —epss 0.01
A cross-site scripting (XSS) vulnerability exists in Sitecore Experience Platform (XP) 7.5 - 10.2 and CMS 7.2 - 7.2 Update-6 that may allow authenticated Sitecore Shell users to be tricked into executing custom JS code. Managed Cloud Standard customers who run the affected…
- risk 0.32cvss 4.9epss 0.02
In Sitecore 8.2, there is absolute path traversal via the shell/Applications/Layouts/IDE.aspx fi parameter and the admin/LinqScratchPad.aspx Reference parameter.
- risk 0.32cvss 4.9epss 0.02
Sitecore CRM 8.1 Rev 151207 allows remote authenticated administrators to read arbitrary files via an absolute path traversal attack on sitecore/shell/download.aspx with the file parameter.
- risk 0.19cvss —epss 0.84
Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter…
- CVE-2019-13493Jul 17, 2019risk 0.03cvss —epss 0.02
In Sitecore 9.0 rev 171002, Persistent XSS exists in the Media Library and File Manager. An authenticated unprivileged user can modify the uploaded file extension parameter to inject arbitrary JavaScript.
- CVE-2009-2163Jun 22, 2009risk 0.03cvss —epss 0.03
Cross-site scripting (XSS) vulnerability in login/default.aspx in Sitecore CMS before 6.0.2 Update-1 090507 allows remote attackers to inject arbitrary web script or HTML via the sc_error parameter.
- CVE-2021-38366Aug 12, 2021risk 0.00cvss —epss 0.03
Sitecore through 10.1, when Update Center is enabled, allows remote authenticated users to upload arbitrary files and achieve remote code execution by visiting an uploaded .aspx file at an admin/Packages URL.
- CVE-2020-13427Jun 22, 2020risk 0.00cvss —epss 0.01
Victor CMS 1.0 has Persistent XSS in admin/users.php?source=add_user via the user_name, user_firstname, or user_lastname parameter.
- CVE-2019-11198Aug 5, 2019risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in Sitecore CMS 9.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) #300583 - List Manager Dashboard module, (2) #307638 - Campaign Creator module, (3) #316994 - Attributes field, (4)…
- CVE-2019-10238Mar 27, 2019risk 0.00cvss —epss 0.01
Sitemagic CMS v4.4 has XSS in SMFiles/FrmUpload.class.php via the filename parameter.
- CVE-2014-100004Jan 13, 2015risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in Sitecore CMS before 7.0 Update-4 (rev. 140120) allows remote attackers to inject arbitrary web script or HTML via the xmlcontrol parameter to the default URI. NOTE: some of these details are obtained from third party information.
- CVE-2009-1055Mar 24, 2009risk 0.00cvss —epss 0.01
Unspecified vulnerability in the web service in Sitecore CMS 5.3.1 rev. 071114 allows remote authenticated users to gain access to security databases, and obtain administrative and user credentials, via unknown vectors related to SOAP and XML requests.