NetBox is an open-source infrastructure resource modeling and IP address management platform. A reflected cross-site scripting (XSS) vulnerability exists in versions 2.11.0 through 3.7.x in the ProtectedError handling logic, where object names are included in HTML error messages without proper escaping. This allows user-controlled content to be rendered in the web interface when a delete operation fails due to protected relationships, potentially enabling execution of arbitrary client-side code in the context of a privileged user.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://github.com/netbox-community/netbox |
Configurations
No configuration.
History
03 Feb 2026, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-03 18:16
Updated : 2026-02-03 18:16
NVD link : CVE-2025-69848
Mitre link : CVE-2025-69848
CVE.ORG link : CVE-2025-69848
JSON object : View
Products Affected
No product.
CWE
No CWE.