CVE-2025-69848CWE-79cross-site-scripting

CVE-2025-69848

Medium · published February 3, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
26.3
In the wild
Unconfirmed
What it is

NetBox is an open-source infrastructure resource modeling and IP address management platform. A reflected cross-site scripting (XSS) vulnerability exists in versions 2.11.0 through 3.7.x in the ProtectedError handling logic, where object names are included in HTML error messages without proper escaping. This allows user-controlled content to be rendered in the web interface when a delete operation fails due to protected relationships, potentially enabling execution of arbitrary client-side code in the context of a privileged user.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00341 · 26.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-02-03T23:16Z
Affected products (1)
ProductVersionsFixed in
netbox/netbox≥ 2.11.0, ≤ 3.7.8—
References (2)
https://github.com/alkimcoskun/CVE-2025-69848-security-advisories · [email protected]https://github.com/netbox-community/netbox · [email protected]
EPSS history
Timeline
  • 03 FEB 00:00Z
    NetBox is an open-source infrastructure resource modeling and IP address management platform
    cvelistv5