Approved changes feed: RSS · Atom
cpe:2.3:a:netbox:netbox:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Netbox (1ff68d88-2759-5d74-bebd-d76508508716) |
|---|---|
| Product | Netbox (3e04301b-f22a-5e70-9655-e1deae6ea256) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/netbox-community/netbox |
purl2cpe | 2026-06-01 10:15:21.853092 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-104073 |
vulnerable | 2026-11-03 10:16:18.967979 |
NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links
HIGH (7.6)
NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template context. Attackers can craft a custom link template embedding request.COOKIES['sessionid'] or a user's API token into an img src URL, which bypasses the clean_html sanitizer and auto-exfiltrates the victim's credentials to an attacker-controlled host when a privileged user views the object, enabling full account takeover.
Published: 2026-10-06T18:50:28.326Z
Updated: 2026-10-27T01:30:32.403Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-86175 |
vulnerable | 2026-09-16 04:32:58.614293 |
NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs
MEDIUM (6.5)
NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to external repositories and storage buckets.
Published: 2026-09-05T11:01:26.738Z
Updated: 2026-09-24T14:21:15.185Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-69848 |
vulnerable | 2026-06-08 07:43:13.903674 |
Details available
NetBox is an open-source infrastructure resource modeling and IP address management platform. A reflected cross-site scripting (XSS) vulnerability exists in versions 2.11.0 through 3.7.x in the ProtectedError handling logic, where object names are included in HTML error messages without proper escaping. This allows user-controlled content to be rendered in the web interface when a delete operation fails due to protected relationships, potentially enabling execution of arbitrary client-side code in the context of a privileged user.
Published: 2026-02-03T00:00:00.000Z
Updated: 2026-08-18T12:52:20.445Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-56918 |
vulnerable | 2026-06-08 06:56:13.272621 |
Details available
In Netbox Community 4.1.7, the login page is vulnerable to cross-site scripting (XSS), which allows a privileged, authenticated attacker to exfiltrate user input from the login form.
Published: 2025-06-24T00:00:00.000Z
Updated: 2025-06-24T19:17:26.988Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-56917 |
vulnerable | 2026-06-08 06:56:13.272345 |
Details available
Netbox Community 4.1.7 is vulnerable to Cross Site Scripting (XSS) via the maintenance banner` in maintenance mode.
Published: 2025-06-24T00:00:00.000Z
Updated: 2025-06-24T19:40:58.461Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-56916 |
vulnerable | 2026-06-08 06:56:13.272052 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-56915 |
vulnerable | 2026-06-08 06:56:13.271664 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-40742 |
vulnerable | 2026-06-08 06:43:53.106040 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-40739 |
vulnerable | 2026-06-08 06:43:53.104524 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-40735 |
vulnerable | 2026-06-08 06:43:53.099016 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-40730 |
vulnerable | 2026-06-08 06:43:53.096899 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-40727 |
vulnerable | 2026-06-08 06:43:53.095382 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-40726 |
vulnerable | 2026-06-08 06:43:53.093427 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-0948 |
vulnerable | 2026-06-08 06:22:03.196883 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-25011 |
vulnerable | 2026-06-08 05:13:41.795027 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.