CVEvulnerability
CVE-2025-57540
5.4 MEDIUM
Official page ↗
- Status
- Analyzed
- Published
- 2025-09-09
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
Description
A stored cross-site scripting (XSS) vulnerability exists in the WebAuthn Relying Party field within the Datacenter configuration of Proxmox Virtual Environment (PVE) 8.4. Authenticated users can inject JavaScript code that is later executed in the browsers of users who view the configuration page, enabling client-side attacks.
Affected configurations
• proxmox virtual environment 8.4
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/page-2#post-792010 Issue Tracking, Vendor Advisory
- https://github.com/khankishiyev-j/bug-bounty/blob/main/proxmox-xss Exploit, Third Party Advisory
- https://www.youtube.com/watch?v=-wvkN-7oT5U Broken Link
- https://github.com/khankishiyev-j/bug-bounty/blob/main/proxmox-xss Exploit, Third Party Advisory