The vulnerability is a Stored Cross‑Site Scripting (XSS) flaw in NetBox 4.3.5. Input entered into the "comment" field on object forms is not properly sanitized and is rendered as arbitrary HTML in the web UI. This allows an attacker who can inject content into the comment field to display malicious scripts or foreign content to other users, potentially enabling phishing or UI redress attacks. The weakness is identified by CWE-79 (Improper Neutralization of Input During Web Page Generation).

The affected product is NetBox version 4.3.5, as identified by the CPE string cpe:2.3:a:netbox:netbox:4.3.5:*:*:*:*:*:*.*. No additional vendor or product information is provided.

The CVSS score is 6.1, indicating moderate severity. EPSS indicates a low exploitation probability (<1%), and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to submit or edit comments in NetBox, implying authenticator access to object forms. Once a comment is injected, the stored payload is rendered for all users who view the form, permitting a broad attack surface but limited to the web UI context. This risk is moderate and primarily concerns user-based attacks rather than system compromise.