CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
CVE-2025-46545: In Sherpa Orchestrator 141851, the functionality for adding or updating licenses allows for stored XSS attacks by an administrator through the name...
4.4
CVSS
Description
In Sherpa Orchestrator 141851, the functionality for adding or updating licenses allows for stored XSS attacks by an administrator through the name parameter. The XSS payload can execute when the license expires.
Classification
CVE ID: CVE-2025-46545
CVSS Base Severity: MEDIUM
CVSS Base Score: 4.4
CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Problem Types
CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')Affected Products
Vendor: Sherpa
Product: Orchestrator
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.04% (probability of being exploited)
EPSS Percentile: 10.06% (scored less or equal to compared to others)
EPSS Date: 2025-05-23 (when was this score calculated)
References
https://nvd.nist.gov/vuln/detail/CVE-2025-46545https://sherparpa.com
https://twitter.com/ArtyomBrylev
https://deiteriy.com
https://gist.github.com/ArtemBrylev/5a0c76285d5fa9daf4ec753034185de7