CVE-2025-46544

In Sherpa Orchestrator 141851, a low-privileged user can elevate their privileges by creating new users and roles...

CVE-2025-46546

CVE-2025-46546 concerns Sherpa Orchestrator 141851 where an authenticated user can perform multiple time-based blind SQL injections. Affects API endpoints across GUI and process/file/task listings (examples: api/gui/asset/list; api/gui/files/export/csv/; api/gui/files/list; api/gui/process/export...

CVE-2025-46546

In Sherpa Orchestrator 141851, multiple time-based blind SQL injections can be performed by an authenticated user. This affects api/gui/asset/list, /api/gui/files/export/csv/, /api/gui/files/list, /api/gui/process/export/csv, /api/gui/process/export/xlsx, /api/gui/process/listAll,...

CVE-2025-46545

In Sherpa Orchestrator 141851, the functionality for adding or updating licenses allows for stored XSS attacks by an administrator through the name parameter. The XSS payload can execute when the license expires...

Sherpa Orchestrator 安全漏洞

Sherpa Orchestrator is an IT management software from Sherpa for automating IT processes and workflow management. A security vulnerability exists in Sherpa Orchestrator version 141851, which stems from the possibility that a low-privileged user could elevate privileges by creating new users and...

Sherpa Orchestrator SQL注入漏洞

Sherpa Orchestrator is an IT management software from Sherpa for automating IT processes and workflow management. A security vulnerability exists in Sherpa Orchestrator version 141851, which stems from the possibility that an authenticated user could perform multiple blind time-based SQL injectio...

CVE-2025-46545

CVE-2025-46545 affects Sherpa Orchestrator v141851. The issue allows stored cross-site scripting via the name parameter when adding or updating licenses, with the payload executing upon license expiration. Evidence across multiple sources confirms the vulnerability and affected component (license...

CVE-2025-46544

In Sherpa Orchestrator 141851, a low-privileged user can elevate their privileges by creating new users and roles...

Sherpa Orchestrator 跨站脚本漏洞

Sherpa Orchestrator is an IT management software from Sherpa for automating IT processes and workflow management. A security vulnerability exists in Sherpa Orchestrator version 141851, which stems from the Add or Update License feature may lead to a stored cross-site scripting attack via the name...

PT-2025-17871 · Unknown · Sherpa Orchestrator

Name of the Vulnerable Software and Affected Versions: Sherpa Orchestrator version 141851 Description: The issue allows for stored XSS attacks by an administrator through the name parameter when adding or updating licenses. The XSS payload can execute when the license expires. Recommendations: Fo...

PT-2025-17869 · Unknown · Sherpa Orchestrator

Name of the Vulnerable Software and Affected Versions: Sherpa Orchestrator version 141851 Description: The web application lacks protection against CSRF attacks, allowing an attacker to conduct XSS attacks, add a new user or role, or exploit a SQL injection issue. Recommendations: For Sherpa...

CVE-2025-46547

In Sherpa Orchestrator 141851, the web application lacks protection against CSRF attacks, with resultant effects of an attacker conducting XSS attacks, adding a new user or role, or exploiting a SQL injection issue...

Sherpa Orchestrator 跨站请求伪造漏洞

Sherpa Orchestrator is an IT management software from Sherpa for automating IT processes and workflow management. A security vulnerability exists in Sherpa Orchestrator version 141851 that stems from a lack of protection against CSRF attacks in the web application, which could lead to XSS attacks...

PT-2025-17870 · Unknown · Sherpa Orchestrator

Name of the Vulnerable Software and Affected Versions: Sherpa Orchestrator version 141851 Description: A low-privileged user can elevate their privileges by creating new users and roles. Recommendations: For Sherpa Orchestrator version 141851, consider restricting the ability of low-privileged...

PT-2025-17872 · Unknown · Sherpa Orchestrator

Name of the Vulnerable Software and Affected Versions: Sherpa Orchestrator version 141851 Description: The issue allows an authenticated user to perform multiple time-based blind SQL injections. This affects several API endpoints, including "api/gui/asset/list", "api/gui/files/export/csv/",...

CVE-2025-46546

In Sherpa Orchestrator 141851, multiple time-based blind SQL injections can be performed by an authenticated user. This affects api/gui/asset/list, /api/gui/files/export/csv/, /api/gui/files/list, /api/gui/process/export/csv, /api/gui/process/export/xlsx, /api/gui/process/listAll,...

CVE-2025-46545

In Sherpa Orchestrator 141851, the functionality for adding or updating licenses allows for stored XSS attacks by an administrator through the name parameter. The XSS payload can execute when the license expires...

CVE-2025-46547

In Sherpa Orchestrator 141851, the web application lacks protection against CSRF attacks, with resultant effects of an attacker conducting XSS attacks, adding a new user or role, or exploiting a SQL injection issue...

CVE-2025-46544

CVE-2025-46544 affects Sherpa Orchestrator 141851. A low-privileged user can elevate privileges by creating new users and roles, as documented by multiple sources in connected documents. The vulnerability description is consistent across feeds; no exploits are provided in the documents. Some advi...

CVE-2025-46547

CVE-2025-46547 : In Sherpa Orchestrator 141851, the web application lacks CSRF protection, enabling an attacker to perform actions such as XSS, adding a new user or role, or triggering SQL injection. The issue is documented across multiple sources (NVD/Red Hat/CIRCL/CVE list) with similar descrip...