CVE-2025-46545

4.8 mediumEPSS 0.3%

Medium (4.8) in sherparpa sherpa orchestrator. EPSS 0.3% chance of exploitation in the next 30 days.

In Sherpa Orchestrator 141851, the functionality for adding or updating licenses allows for stored XSS attacks by an administrator through the name parameter. The XSS payload can execute when the license expires.

Severity

CVSS 3.1

4.8 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2025-04-25
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

sherparpa:sherpa_orchestrator

References

https://deiteriy.com
https://gist.github.com/ArtemBrylev/5a0c76285d5fa9daf4ec753034185de7
https://sherparpa.com
https://twitter.com/ArtyomBrylev

Check your stack JSON