CVE-2023-35813 Code injection in n/a
Attackers can execute arbitrary code remotely on Sitecore Experience Manager, Platform, and Commerce products.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-35813?
CVE-2023-35813 is a critical code injection vulnerability in n/a, published on 17 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce through 10.3.
Weakness: CWE-94
Which versions are affected by CVE-2023-35813?
It affects 4 products.
Products include Sitecore Experience Commerce, Sitecore Experience Manager, Sitecore Experience Platform, Sitecore Managed Cloud.
How do I fix CVE-2023-35813?
No fix has been published for CVE-2023-35813 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-35813 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-35813 exists.
Public exploit code: 1 Nuclei template and 5 proofs of concept on GitHub.
Other vulnerabilities in n/a
- CVE-2025-53690 Sitecore Multiple Products Deserialization of Untrusted Data
- CVE-2025-53693 HTML Cache Poisoning through Unsafe Reflections
- CVE-2025-53691 Sitecore Experience Remote Code Execution through Insecure Deserialization
- CVE-2025-34510 Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip
- CVE-2025-34511 Sitecore PowerShell Extension RCE via Unrestricted Upload
Sources
Also known as GHSA-q6mf-24rq-66wc.