VULNERABILITY INTELLIGENCE

CVE-2025-46545

CVSS score4.4 MEDIUM
EPSS probability0.29%
CISA KEVNot currently listed
Published2025-04-25
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Description

In Sherpa Orchestrator 141851, the functionality for adding or updating licenses allows for stored XSS attacks by an administrator through the name parameter. The XSS payload can execute when the license expires.

Weakness classification

  • cve@mitre.org: CWE-79

Primary references