Filtered by vendor Sitecore Subscriptions
Filtered by product Sitecore Subscriptions
Total 4 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2022-4979 1 Sitecore 4 Cms, Experience Platform, Managed Cloud and 1 more 2025-07-31 N/A
A cross-site scripting (XSS) vulnerability exists in Sitecore Experience Platform (XP) 7.5 - 10.2 and CMS 7.2 - 7.2 Update-6 that may allow authenticated Sitecore Shell users to be tricked into executing custom JS code. Managed Cloud Standard customers who run the affected Sitecore Experience Platform / CMS versions are also affected.
CVE-2020-36850 1 Sitecore 1 Sitecore 2025-07-31 N/A
An information disclosure vulnerability exits in Sitecore JSS React Sample Application 11.0.0 - 14.0.1 that may cause page content intended for one user to be shown to another user.
CVE-2015-10142 1 Sitecore 3 Cms, Experience Platform, Sitecore 2025-07-31 N/A
Sitecore Experience Platform (XP) prior to 8.0 Initial Release (rev. 141212) and Content Management System (CMS) prior to 7.2 Update-3 (rev. 141226) and prior to 7.5 Update-1 (rev. 150130) contain a vulnerability that may allow an attacker to download files under the web root of the site when the name of the file is already known via a specially-crafted URL. Affected files do not include .config, .aspx or .cs files. The issue does not allow for directory browsing.
CVE-2021-38366 1 Sitecore 1 Sitecore 2024-11-21 8.8 High
Sitecore through 10.1, when Update Center is enabled, allows remote authenticated users to upload arbitrary files and achieve remote code execution by visiting an uploaded .aspx file at an admin/Packages URL.