Netbox
Netbox: vulnerabilidades y CVE
Netbox tiene 50 vulnerabilidades publicadas, 6 de ellas en los últimos 12 meses. 1 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE50
Últimos 12 meses6
Críticas1
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-86175 | Alta (7.1) | 0.46% | — | 5 sept 2026 | NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git… |
| CVE-2026-86176 | Media (5.3) | 0.34% | — | 5 sept 2026 | NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users'… |
| CVE-2026-69117 | Alta (7.1) | 0.32% | — | 11 ago 2026 | NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup expressions into nested object references by… |
| CVE-2026-29514 | Alta (8.7) | 1.1% | — | 4 may 2026 | NetBox versions 4.3.5 through 4.5.4 contain a remote code execution vulnerability in the RenderTemplateMixin.get_environment_params() method that allows authenticated users with exporttemplate or configtemplate… |
| CVE-2025-57543 | Media (6.1) | 0.18% | — | 16 mar 2026 | Cross Site scripting vulnerability (XSS) in NetBox 4.3.5 "comment" field on object forms. An attacker can inject arbitrary HTML, which will be rendered in the web UI when viewed by other users. This could potentially… |
| CVE-2025-69848 | Media (5.4) | 0.31% | — | 3 feb 2026 | NetBox is an open-source infrastructure resource modeling and IP address management platform. A reflected cross-site scripting (XSS) vulnerability exists in versions 2.11.0 through 3.7.x in the ProtectedError handling… |
| CVE-2024-56915 | Media (6.5) | 0.46% | — | 26 jun 2025 | Netbox Community v4.1.7 and fixed in v.4.2.2 is vulnerable to Cross Site Scripting (XSS) via the RSS feed widget. |
| CVE-2024-56917 | Alta (7.1) | 0.39% | — | 24 jun 2025 | Netbox Community 4.1.7 is vulnerable to Cross Site Scripting (XSS) via the maintenance banner` in maintenance mode. |
| CVE-2024-56916 | Media (6.1) | 0.32% | — | 24 jun 2025 | In Netbox Community 4.1.7, once authenticated, Configuration History > Add`is vulnerable to cross-site scripting (XSS) due to the `current value` field rendering user supplied html. An authenticated attacker can… |
| CVE-2024-56918 | Media (6.1) | 0.33% | — | 24 jun 2025 | In Netbox Community 4.1.7, the login page is vulnerable to cross-site scripting (XSS), which allows a privileged, authenticated attacker to exfiltrate user input from the login form. |
| CVE-2024-47226 | Media (5.4) | 0.31% | — | 22 sept 2024 | A stored cross-site scripting (XSS) vulnerability exists in NetBox 4.1.0 within the "Configuration History" feature of the "Admin" panel via a /core/config-revisions/ Add action. An authenticated user can inject… |
| CVE-2024-40742 | Media (6.1) | 0.45% | — | 9 jul 2024 | A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the circuit ID parameter at /circuits/circuits/add. |
| CVE-2024-40741 | Media (6.1) | 0.40% | — | 9 jul 2024 | A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the circuit ID parameter at /circuits/circuits/{id}/edit/. |
| CVE-2024-40740 | Media (6.1) | 0.40% | — | 9 jul 2024 | A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-feeds/{id}/edit/. |
| CVE-2024-40739 | Media (6.1) | 0.38% | — | 9 jul 2024 | A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-feeds/add. |
| CVE-2024-40738 | Media (6.1) | 0.35% | — | 9 jul 2024 | A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/console-ports/{id}/edit/. |
| CVE-2024-40737 | Media (6.1) | 0.35% | — | 9 jul 2024 | A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/console-ports/add. |
| CVE-2024-40736 | Media (6.1) | 0.35% | — | 9 jul 2024 | A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-outlets/add. |
| CVE-2024-40735 | Media (6.1) | 0.35% | — | 9 jul 2024 | A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-outlets/{id}/edit/. |
| CVE-2024-40734 | Media (6.1) | 0.40% | — | 9 jul 2024 | A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/front-ports/add/. |
| CVE-2024-40733 | Media (6.1) | 0.40% | — | 9 jul 2024 | A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/front-ports/{id}/edit/. |
| CVE-2024-40732 | Media (6.1) | 0.40% | — | 9 jul 2024 | A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/rear-ports/add/. |
| CVE-2024-40731 | Media (6.1) | 0.35% | — | 9 jul 2024 | A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/rear-ports/{id}/edit/. |
| CVE-2024-40730 | Media (6.1) | 0.40% | — | 9 jul 2024 | A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/interfaces/{id}/edit/. |
| CVE-2024-40729 | Media (6.1) | 0.40% | — | 9 jul 2024 | A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/interfaces/add/. |
| CVE-2024-40728 | Media (6.1) | 0.35% | — | 9 jul 2024 | A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/console-server-ports/{id}/edit/. |
| CVE-2024-40727 | Media (6.1) | 0.35% | — | 9 jul 2024 | A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/console-server-ports/add/. |
| CVE-2024-40726 | Media (6.1) | 0.38% | — | 9 jul 2024 | A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-ports/{id}/edit/. |
| CVE-2024-38972 | Media (6.1) | 0.35% | — | 9 jul 2024 | A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-ports/add/. |
| CVE-2024-0948 | Media (6.1) | 0.53% | — | 26 ene 2024 | ** DISPUTED ** A vulnerability, which was classified as problematic, has been found in NetBox up to 3.7.0. This issue affects some unknown processing of the file /core/config-revisions of the component Home Page… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.