Sherparpa's vulnerability exposure centers on Sherpa Orchestrator, a workflow and orchestration platform, with a durable signal across web-application input-handling and authorization weaknesses including cross-site scripting, SQL injection, cross-site request forgery, and improper authorization controls. Treat this as a compact vendor profile; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Sherparpa over time
Signals from CVEs in this vendor scope (4 CVEs).
4 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-46546HIGH In Sherpa Orchestrator 141851, multiple time-based blind SQL injections can be performed by an authenticated user. This affects api/gui/asset/list, /api/gui/files/export/csv/, /api | Apr 25, 2025 | 8.8 | 24 | NO | NO |
CVE-2025-46544MEDIUM In Sherpa Orchestrator 141851, a low-privileged user can elevate their privileges by creating new users and roles. | Apr 25, 2025 | 6.5 | 19 | NO | NO |
CVE-2025-46547MEDIUM In Sherpa Orchestrator 141851, the web application lacks protection against CSRF attacks, with resultant effects of an attacker conducting XSS attacks, adding a new user or role, o | Apr 25, 2025 | 6.1 | 18 | NO | NO |
CVE-2025-46545MEDIUM In Sherpa Orchestrator 141851, the functionality for adding or updating licenses allows for stored XSS attacks by an administrator through the name parameter. The XSS payload can e | Apr 25, 2025 | 4.8 | 16 | NO | NO |
Signals from CVEs in this vendor scope (4 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Sherparpa.
Media articles that mention a CVE ID that affects a product developed by Sherparpa — matched by CVE ID, not by vendor name.