PT-2025-36794

CVE-2025-57540

Published

2025-09-09

Updated

2025-09-17

Description by

CVSS 3.1

5.4

Medium

MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Proxmox Virtual Environment version 8.4

Description: A stored cross-site scripting (XSS) issue exists in the WebAuthn Relying Party field within the Datacenter configuration. Authenticated users can inject JavaScript code that is later executed in the browsers of users who view the configuration page, enabling client-side attacks.

Recommendations: Update to a newer version that contains a fix for this issue.

Exploitability

Exploit

Fix

Impacts

Researchers

Khankishiyev-J

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers