Threat database

7 threats

Severity	CVSS	Signals	Threat	Source	Published
Medium	6.9	EPSS 0.4%	CVE-2026-104073netbox · Resource Exposure Medium6.9EPSS 0.4%2026-10-06CVE Database V5CVE-2026-104073 NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template context. Attackers can craft a custom link template embedding request.COOKIES['sessionid'] or a user's API token into an img src URL, which bypasses the clean_html sanitizer and auto-exfiltrates the victim's credentials to an attacker-controlled host when a privileged user views the object, enabling full account takeover. EPSS 0.4%Vulnerability netbox-community	CVE Database V5	2026-10-06
Medium	5.4	EPSS 0.3%	CVE-2025-69848netbox · n/a Medium5.4EPSS 0.3%2026-02-03CVE Database V5CVE-2025-69848 NetBox is an open-source infrastructure resource modeling and IP address management platform. A reflected cross-site scripting (XSS) vulnerability exists in versions 2.11.0 through 3.7.x in the ProtectedError handling logic, where object names are included in HTML error messages without proper escaping. This allows user-controlled content to be rendered in the web interface when a delete operation fails due to protected relationships, potentially enabling execution of arbitrary client-side code in the context of a privileged user. EPSS 0.3%Vulnerability	CVE Database V5	2026-02-03
High	7.1	EPSS 0.4%	CVE-2024-40740netbox · n/a High7.1EPSS 0.4%2024-07-09CVE Database V5CVE-2024-40740 A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-feeds/{id}/edit/. EPSS 0.4%Vulnerability	CVE Database V5	2024-07-09
Medium	6.1	EPSS 0.4%	CVE-2024-40736netbox · n/a Medium6.1EPSS 0.4%2024-07-09CVE Database V5CVE-2024-40736 A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-outlets/add. EPSS 0.4%Vulnerability	CVE Database V5	2024-07-09
Medium	6.1	EPSS 0.4%	CVE-2024-40735netbox · n/a Medium6.1EPSS 0.4%2024-07-09CVE Database V5CVE-2024-40735 A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-outlets/{id}/edit/. EPSS 0.4%Vulnerability	CVE Database V5	2024-07-09
High	7.1	EPSS 0.4%	CVE-2024-40732netbox · n/a High7.1EPSS 0.4%2024-07-09CVE Database V5CVE-2024-40732 A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/rear-ports/add/. EPSS 0.4%Vulnerability	CVE Database V5	2024-07-09
High	7.1	EPSS 0.4%	CVE-2024-40728netbox · n/a High7.1EPSS 0.4%2024-07-09CVE Database V5CVE-2024-40728 A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/console-server-ports/{id}/edit/. EPSS 0.4%Vulnerability	CVE Database V5	2024-07-09

Page 1 of 1