CVE-2025-57543

Cross Site scripting vulnerability (XSS) in NetBox 4.3.5 "comment" field on object forms. An attacker can inject arbitrary HTML, which will be rendered in the web UI when viewed by other users. This could potentially lead to user interface redress attacks or be escalated to XSS in certain contexts.

• CWE-79

• https://gist.github.com/MerttTuran/d94acff59816bfd9492d1a738e89ebb4Exploit, Third Party Advisory
• https://gist.github.com/MerttTuran/d94acff59816bfd9492d1a738e89ebb4Exploit, Third Party Advisory

Published

Mar 16, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-57529YouDataSum CPAS Audit Management System <=v4.9 is vulnerable…9.8
• CVE-2025-5753The Valuation Calculator plugin for WordPress is vulnerable …6.4
• CVE-2025-57538A stored cross-site scripting (XSS) vulnerability in the HTT…5.4
• CVE-2025-57539A stored cross-site scripting (XSS) vulnerability in the U2F…5.4
• CVE-2025-5754The Useful Tab Block – Responsive & AMP-Compatible plugin fo…6.4
• CVE-2025-57540A stored cross-site scripting (XSS) vulnerability exists in …5.4
• CVE-2025-5755A vulnerability was found in SourceCodester Open Source Clin…7.3
• CVE-2025-5756A vulnerability was found in code-projects Real Estate Prope…9.8
• CVE-2025-57563A path traversal in StarNet Communications Corporation FastX…6.5
• CVE-2025-57564CubeAPM nightly-2025-08-01-1 allow unauthenticated attackers…8.2
• CVE-2025-57567A remote code execution (RCE) vulnerability exists in the Pl…9.1
• CVE-2025-57569Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffe…5.6