PT-2026-25761 · Git+1 · Netbox

Publicado 2026-03-16 · Atualizado 2026-03-17 · CVE-2025-57543

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions NetBox version 4.3.5

Description A cross-site scripting issue exists in NetBox version 4.3.5 within the “comment” field on object forms. An attacker can inject arbitrary HTML, which is then rendered in the web user interface when viewed by other users. This could potentially lead to user interface redress attacks or be escalated to XSS in certain contexts. The vulnerable parameter is comment.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-57543

Produtos afetados

Netbox

Referências · 5

• 🔥 https://gist.github.com/MerttTuran/d94acff59816bfd9492d1a738e89ebb4 · Exploit
• https://twitter.com/VulmonFeeds/status/2033646090994499867 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2033755374751195404 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-57543 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-57543 · Nota de Segurança