CVE-2025-57543

Cross Site scripting vulnerability (XSS) in NetBox 4.3.5 "comment" field on object forms

Medium · published March 16, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
7.3
In the wild
Unconfirmed
What it is

Cross Site scripting vulnerability (XSS) in NetBox 4.3.5 "comment" field on object forms. An attacker can inject arbitrary HTML, which will be rendered in the web UI when viewed by other users. This could potentially lead to user interface redress attacks or be escalated to XSS in certain contexts.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00182 · 7.3th percentile
Published
2026-03-16T00:00Z
EPSS history
Timeline
  • 16 MAR 00:00Z
    Cross Site scripting vulnerability (XSS) in NetBox 4.3.5 "comment" field on object forms
    cvelistv5