CVE-2025-46545
- State
- Published
- Severity
- 4.4 Medium
- Published
- Apr 25, 2025
- Updated
- Apr 25, 2025
- Reserved
- Apr 24, 2025
Description
In Sherpa Orchestrator 141851, the functionality for adding or updating licenses allows for stored XSS attacks by an administrator through the name parameter. The XSS payload can execute when the license expires.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.4 Medium | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N | mitre |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
OrchestratorSherpa |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.