Skip to content
Threat Feed

Product

Netbox-Data-Flows (<= 1.5.0)

1 brief RSS
high advisory

netbox-data-flows Stored XSS Vulnerability in ObjectAlias Names

The netbox-data-flows plugin is vulnerable to stored cross-site scripting (XSS). An authenticated user with permissions to create or edit ObjectAlias objects can inject arbitrary HTML/JavaScript into the alias name. This payload is then rendered unescaped in DataFlow table views, leading to XSS when another user views the affected page. Successful exploitation can result in session theft, privileged action execution, and data exfiltration.

netbox-data-flows xss netbox data-flows stored-xss
2r 1t