Low severity3.5NVD Advisory· Published Apr 25, 2025· Updated Jun 17, 2026

CVE-2025-46546

Description

In Sherpa Orchestrator 141851, multiple time-based blind SQL injections can be performed by an authenticated user. This affects api/gui/asset/list, /api/gui/files/export/csv/, /api/gui/files/list, /api/gui/process/export/csv, /api/gui/process/export/xlsx, /api/gui/process/listAll, /api/gui/processVersion/export/csv/, /api/gui/processVersion/export/xlsx/, /api/gui/processVersion/list/, /api/gui/robot/list/, /api/gui/task/export/csv/, /api/gui/task/export/xlsx/, and /api/gui/task/list/.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Sherpa/Sherpa Orchestratorllm-fuzzy2 versions
141851+ 1 more
- (no CPE)range: 141851
- (no CPE)range: 141851

Patches

Vulnerability mechanics

References

gist.github.com/ArtemBrylev/59b4c0825a988f39a58b79e4e8d2f378nvdThird Party Advisory
deiteriy.comnvdNot Applicable
sherparpa.comnvdProduct
twitter.com/ArtyomBrylevnvdNot Applicable

News mentions

No linked articles in our index yet.

cvss	0.227
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000