What’s Vulnerable › Vulnerabilities

CVE-2025-57540

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-09-09 · updated 2026-06-17
• Weakness: CWE-79

Description

A stored cross-site scripting (XSS) vulnerability exists in the WebAuthn Relying Party field within the Datacenter configuration of Proxmox Virtual Environment (PVE) 8.4. Authenticated users can inject JavaScript code that is later executed in the browsers of users who view the configuration page, enabling client-side attacks.

Affected products

• Proxmox Virtual Environment: 8.4

References

• https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/page-2#post-792010
• https://github.com/khankishiyev-j/bug-bounty/blob/main/proxmox-xss
• https://www.youtube.com/watch?v=-wvkN-7oT5U
• https://github.com/khankishiyev-j/bug-bounty/blob/main/proxmox-xss

Get alerted when CVE-2025-57540 or the next vulnerability affects your stack