CVE-2025-57540

Published: Sep 9, 2025Modified: Sep 17, 2025

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

A stored cross-site scripting (XSS) vulnerability exists in the WebAuthn Relying Party field within the Datacenter configuration of Proxmox Virtual Environment (PVE) 8.4. Authenticated users can inject JavaScript code that is later executed in the browsers of users who view the configuration page, enabling client-side attacks.

Affected (1)

Products: Proxmox: Virtual Environment

1 product

Virtual Environment

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Proxmox Virtual Environment	Version 8.4

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/page-2#post-792010

Source: cve@mitre.org

Issue TrackingVendor Advisory

https://github.com/khankishiyev-j/bug-bounty/blob/main/proxmox-xss

Source: cve@mitre.org

ExploitThird Party Advisory

https://www.youtube.com/watch?v=-wvkN-7oT5U

Source: cve@mitre.org

Broken Link

https://github.com/khankishiyev-j/bug-bounty/blob/main/proxmox-xss

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitThird Party Advisory

Timeline

No history available yet.