Netbox

CVE-2026-54752 Sep 17, 20:16 CRITICAL PATCH Act Now

Arbitrary code execution is possible inside the NetBox Device Type Library's pytest validation harness because the test suite deserializes pull-request-controlled pickle cache files via pickle.load. An unauthenticated contributor can flip USE_LOCAL_KNOWN_SLUGS in tests/test_configuration.py and commit a crafted tests/known-modules.pickle or tests/known-racks.pickle in the same pull request, so the payload fires whenever the tests are run: automatically by the GitHub Actions validation workflow on the PR, or by a maintainer executing pytest locally against the untrusted branch (the user-interaction requirement in the CVSS vector). Affected deployments are the repository's CI pipeline and any maintainer workstation running the suite, not NetBox servers that merely import the library's device definitions; no public exploit code has been identified at time of analysis, and GitHub Actions exposure is bounded by the read-only token granted to pull_request workflows, while a privileged local test run carries full confidentiality, integrity and availability impact.

CVE-2026-86175 Sep 05, 11:01 HIGH POC This Week

Credential exposure in NetBox through 4.7.0 allows any authenticated user with only view-level permissions to retrieve plaintext Git passwords and Amazon S3 secret access keys via the REST API and GraphQL interfaces. The flaw is rooted in missing field-level redaction in the API serializer and GraphQL type layer, and represents an incomplete remediation of a previously reported issue (GitHub issue #12625). A public proof-of-concept is available, and successful exploitation grants attackers direct access to external Git repositories and S3 storage buckets configured as NetBox data source backends - extending the breach well beyond the NetBox instance itself.

CVE-2026-69117 Aug 11, 18:29 HIGH PATCH This Week

ORM injection in NetBox 4.5.8's WritableNestedSerializer allows any authenticated user - including those holding only read-only API tokens - to extract sensitive field values across all application modules via boolean-based blind data leakage. By supplying crafted Django ORM lookup expressions as JSON dictionary keys in REST API write requests, attackers bypass object-level permission controls across dcim, ipam, tenancy, virtualization, circuits, and extras. No CISA KEV listing exists, but VulnCheck reported the issue and an upstream fix commit is available; no confirmed public exploit code has been identified at time of analysis.

CVE-2026-29514 May 04, 16:05 HIGH POC This Week

Remote code execution in NetBox 4.3.5-4.5.4 allows authenticated users with exporttemplate or configtemplate permissions to execute arbitrary Python code as the NetBox service user by injecting malicious callables into Jinja2 template environment parameters. Attackers bypass SandboxedEnvironment protections by setting the finalize parameter to dangerous imports like subprocess.getoutput, which executes on every rendered expression outside sandbox call interception. Public proof-of-concept exploit exists (chocapikk.com), and upstream patch available via GitHub PR #22078 implements an allowlist-based validation mechanism that blocks unauthorized callable resolution at both save-time and render-time.

CVE-2026-104073 Oct 06, 18:50 MEDIUM PATCH This Month

Session cookie and API token theft in NetBox versions 2.9.5 through 4.6.x lets an authenticated user holding the "Can add custom links" permission exfiltrate the credentials of higher-privileged users who merely view an affected object. The flaw exposes the raw Django HttpRequest object to the Jinja2 custom-link template context, so an attacker can embed request.COOKIES['sessionid'] or a victim's API token inside an <img src> URL that slips past the clean_html sanitizer and auto-transmits to an attacker-controlled host when a privileged user opens the page, enabling full account takeover. Exploitation is conditional: it requires a delegated custom-link permission (PR:L) and a privileged victim to passively trigger the payload (UI:P), and no public exploit has been identified at time of analysis; upgrading to NetBox 4.7.0, which substitutes a sanitized request subset, removes the exposure entirely.

CVE-2026-86176 Sep 05, 11:01 MEDIUM POC This Month

Cross-user disclosure in NetBox through 4.7.0 exposes all users' private Notifications, Subscriptions, and Bookmark records to any authenticated user with standard view permissions, via unscoped querysets in both the REST API and GraphQL API. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): affected endpoints return the full table rather than filtering records to the requesting user's identity. A publicly available proof-of-concept exists demonstrating exploitation against a default 4.7.0 installation; no active exploitation has been confirmed in CISA KEV.

CVE-2025-69848 Feb 03, 18:16 MEDIUM This Month

NetBox is an open-source infrastructure resource modeling and IP address management platform. [CVSS 5.4 MEDIUM]

CVE-2024-56915 Jun 26, 15:15 MEDIUM POC This Month

Netbox Community v4.1.7 and fixed in v.4.2.2 is vulnerable to Cross Site Scripting (XSS) via the RSS feed widget.

CVE-2024-56917 Jun 24, 20:15 HIGH POC This Week

A cross-site scripting vulnerability in Netbox Community 4.1.7 (CVSS 7.1). Risk factors: public PoC available.

CVE-2024-56916 Jun 24, 18:15 MEDIUM POC This Month

In Netbox Community 4.1.7, once authenticated, Configuration History > Add`is vulnerable to cross-site scripting (XSS) due to the `current value` field rendering user supplied html. An authenticated attacker can leverage this to add malicious JavaScript to the any banner field. Once a victim edits a Configuration History version or attempts to Add a new version, the XSS payload will trigger.

CVE-2024-56918 Jun 24, 17:15 MEDIUM POC This Month

In Netbox Community 4.1.7, the login page is vulnerable to cross-site scripting (XSS), which allows a privileged, authenticated attacker to exfiltrate user input from the login form.

CVE-2024-47226 Sep 22, 02:15 PyPI MEDIUM POC This Month

A stored cross-site scripting (XSS) vulnerability exists in NetBox 4.1.0 within the "Configuration History" feature of the "Admin" panel via a /core/config-revisions/ Add action. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-40742 Jul 09, 18:15 MEDIUM POC This Month

A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the circuit ID parameter at. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-40741 Jul 09, 18:15 MEDIUM POC This Month

A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the circuit ID parameter at. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-40740 Jul 09, 18:15 MEDIUM POC This Month

A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-40739 Jul 09, 18:15 MEDIUM POC This Month

A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-feeds/add. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-40738 Jul 09, 18:15 MEDIUM POC This Month

A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-40737 Jul 09, 18:15 MEDIUM POC This Month

A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/console-ports/add. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-40736 Jul 09, 18:15 MEDIUM POC This Month

A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-outlets/add. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-40735 Jul 09, 18:15 MEDIUM POC This Month

A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-40734 Jul 09, 18:15 MEDIUM POC This Month

A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/front-ports/add/. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-40733 Jul 09, 18:15 MEDIUM POC This Month

A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-40732 Jul 09, 18:15 MEDIUM POC This Month

A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/rear-ports/add/. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-40731 Jul 09, 18:15 MEDIUM POC This Month

A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-40730 Jul 09, 18:15 MEDIUM POC This Month

A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-40729 Jul 09, 18:15 MEDIUM POC This Month

A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/interfaces/add/. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-40728 Jul 09, 18:15 MEDIUM POC This Month

A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-40727 Jul 09, 18:15 MEDIUM POC This Month

A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-40726 Jul 09, 18:15 MEDIUM POC This Month

A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-38972 Jul 09, 18:15 MEDIUM POC This Month

A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-ports/add/. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-0948 Jan 26, 22:15 MEDIUM POC This Month

** DISPUTED ** A vulnerability, which was classified as problematic, has been found in NetBox up to 3.7.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-36234 Sep 20, 22:15 MEDIUM POC This Month

Cross Site Scripting (XSS) vulnerability in Netbox 3.5.1, allows attackers to execute arbitrary code via Name field in device-roles/add function. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-37625 Aug 10, 20:15 MEDIUM POC This Month

A stored cross-site scripting (XSS) vulnerability in Netbox v3.4.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Link templates. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-34565 Jun 14, 21:15 MEDIUM POC This Month

Netbox 3.5.1 is vulnerable to Cross Site Scripting (XSS) in the "Create Wireless LAN Groups" function. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-33800 May 24, 20:15 MEDIUM POC This Month

A stored cross-site scripting (XSS) vulnerability in the Create Regions (/dcim/regions/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-33799 May 24, 20:15 MEDIUM POC This Month

A stored cross-site scripting (XSS) vulnerability in the Create Contacts (/tenancy/contacts/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-33798 May 24, 20:15 MEDIUM POC This Month

A stored cross-site scripting (XSS) vulnerability in the Create Rack (/dcim/rack/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-33797 May 24, 20:15 MEDIUM POC This Month

A stored cross-site scripting (XSS) vulnerability in the Create Sites (/dcim/sites/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-33796 May 24, 20:15 CRITICAL POC Act Now

A vulnerability in Netbox v3.5.1 allows unauthenticated attackers to execute queries against the GraphQL database, granting them access to sensitive data stored in the database. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-33795 May 24, 20:15 MEDIUM POC This Month

A stored cross-site scripting (XSS) vulnerability in the Create Contact Roles (/tenancy/contact-roles/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-33794 May 24, 20:15 MEDIUM POC This Month

A stored cross-site scripting (XSS) vulnerability in the Create Tenants (/tenancy/tenants/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-33793 May 24, 20:15 MEDIUM POC This Month

A stored cross-site scripting (XSS) vulnerability in the Create Power Panels (/dcim/power-panels/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-33792 May 24, 20:15 MEDIUM POC This Month

A stored cross-site scripting (XSS) vulnerability in the Create Site Groups (/dcim/site-groups/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-33791 May 24, 20:15 MEDIUM POC This Month

A stored cross-site scripting (XSS) vulnerability in the Create Provider Accounts (/circuits/provider-accounts/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-33790 May 24, 20:15 MEDIUM POC This Month

A stored cross-site scripting (XSS) vulnerability in the Create Locations (/dcim/locations/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-33789 May 24, 20:15 MEDIUM POC This Month

A stored cross-site scripting (XSS) vulnerability in the Create Contact Groups (/tenancy/contact-groups/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-33788 May 24, 20:15 MEDIUM POC This Month

A stored cross-site scripting (XSS) vulnerability in the Create Providers (/circuits/providers/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-33787 May 24, 20:15 MEDIUM POC This Month

A stored cross-site scripting (XSS) vulnerability in the Create Tenant Groups (/tenancy/tenant-groups/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-33786 May 24, 20:15 MEDIUM POC This Month

A stored cross-site scripting (XSS) vulnerability in the Create Circuit Types (/circuits/circuit-types/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-33785 May 24, 20:15 MEDIUM POC This Month

A stored cross-site scripting (XSS) vulnerability in the Create Rack Roles (/dcim/rack-roles/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.