4.8
CVE-2025-46545
- EPSS 0.19%
- Veröffentlicht 25.04.2025 00:00:00
- Zuletzt bearbeitet 15.10.2025 18:30:33
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginIn Sherpa Orchestrator 141851, the functionality for adding or updating licenses allows for stored XSS attacks by an administrator through the name parameter. The XSS payload can execute when the license expires.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Sherparpa ≫ Sherpa Orchestrator Version141851
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.19% | 0.408 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 4.8 | 1.7 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
|
| cve@mitre.org | 4.4 | 1.3 | 2.7 |
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.