Description
NetBox is an open-source infrastructure resource modeling and IP address management platform. A reflected cross-site scripting (XSS) vulnerability exists in versions 2.11.0 through 3.7.x in the ProtectedError handling logic, where object names are included in HTML error messages without proper escaping. This allows user-controlled content to be rendered in the web interface when a delete operation fails due to protected relationships, potentially enabling execution of arbitrary client-side code in the context of a privileged user.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
alkimcoskun/CVE-2025-69848-security-advisories ★ 0 · Feb 2, 2026
Security advisory for CVE-2025-69848 – Reflected XSS in NetBox ProtectedError handling
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- WID-SEC-2026-0294 NetBox: Schwachstelle ermöglicht Cross-Site Scripting BSI CERT-Bund (WID) · Feb 3, 2026