CVE-2025-57543

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-57543
Cross Site scripting vulnerability (XSS) in NetBox 4.3.5 "comment" field on object forms. An attacker can inject arbitrary HTML, which will be rendered in the web UI when viewed by other users. This could potentially lead to user interface redress attacks or be escalated to XSS in certain contexts.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://gist.github.com/MerttTuran/d94acff59816bfd9492d1a738e89ebb4 Exploit Third Party Advisory
https://gist.github.com/MerttTuran/d94acff59816bfd9492d1a738e89ebb4 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:netbox:netbox:4.3.5:*:*:*:*:*:*:*
History

20 Mar 2026, 13:56

Type Values Removed Values Added
Summary
  • (es) Vulnerabilidad de scripting entre sitios (XSS) en NetBox 4.3.5 en el campo 'comment' de los formularios de objetos. Un atacante puede inyectar HTML arbitrario, que se renderizará en la interfaz de usuario web cuando sea visto por otros usuarios. Esto podría llevar potencialmente a ataques de manipulación de la interfaz de usuario o ser escalado a XSS en ciertos contextos.
First Time Netbox netbox
Netbox
CPE cpe:2.3:a:netbox:netbox:4.3.5:*:*:*:*:*:*:*
References () https://gist.github.com/MerttTuran/d94acff59816bfd9492d1a738e89ebb4 - () https://gist.github.com/MerttTuran/d94acff59816bfd9492d1a738e89ebb4 - Exploit, Third Party Advisory

16 Mar 2026, 20:16

Type Values Removed Values Added
References () https://gist.github.com/MerttTuran/d94acff59816bfd9492d1a738e89ebb4 - () https://gist.github.com/MerttTuran/d94acff59816bfd9492d1a738e89ebb4 -
CWE CWE-79
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.1

16 Mar 2026, 16:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-16 16:16

Updated : 2026-03-20 13:56

NVD link : CVE-2025-57543

Mitre link : CVE-2025-57543

CVE.ORG link : CVE-2025-57543

JSON object : View

Products Affected

netbox

  • netbox
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')