PT-2026-25761 · Git+1 · Netbox

Published 2026-03-16 · Updated 2026-03-17 · CVE-2025-57543

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions NetBox version 4.3.5

Description A cross-site scripting issue exists in NetBox version 4.3.5 within the “comment” field on object forms. An attacker can inject arbitrary HTML, which is then rendered in the web user interface when viewed by other users. This could potentially lead to user interface redress attacks or be escalated to XSS in certain contexts. The vulnerable parameter is comment.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-57543

Affected Products

Netbox

References · 5

• 🔥 https://gist.github.com/MerttTuran/d94acff59816bfd9492d1a738e89ebb4 · Exploit
• https://osv.dev/vulnerability/CVE-2025-57543 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-57543 · Security Note
• https://twitter.com/VulmonFeeds/status/2033646090994499867 · Twitter Post
• https://twitter.com/CVEnew/status/2033755374751195404 · Twitter Post