CVE-2025-57539

5.4 mediumEPSS 0.3%

Medium (5.4) in proxmox virtual environment. EPSS 0.3% chance of exploitation in the next 30 days.

A stored cross-site scripting (XSS) vulnerability in the U2F Origin field of the Datacenter configuration in Proxmox Virtual Environment (PVE) 8.4 allows authenticated users to store malicious input. The payload is rendered unsafely in the Web UI and executed when viewed by other users, potentially leading to session hijacking or other attacks.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2025-09-09
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

proxmox:virtual_environment

References

https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/page-2#post-792010
https://github.com/khankishiyev-j/bug-bounty/blob/main/proxmox-xss
https://www.youtube.com/watch?v=-wvkN-7oT5U
https://github.com/khankishiyev-j/bug-bounty/blob/main/proxmox-xss

Check your stack JSON