Home

Description

In Sherpa Orchestrator 141851, the functionality for adding or updating licenses allows for stored XSS attacks by an administrator through the name parameter. The XSS payload can execute when the license expires.

PUBLISHED Reserved 2025-04-24 | Published 2025-04-25 | Updated 2025-04-25 | Assigner mitre




MEDIUM: 4.4CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Product status

Default status
unknown

141851 (custom)
affected

References

sherparpa.com

twitter.com/ArtyomBrylev

deiteriy.com

gist.github.com/ArtemBrylev/5a0c76285d5fa9daf4ec753034185de7

cve.org (CVE-2025-46545)

nvd.nist.gov (CVE-2025-46545)

Download JSON