23 matches found
CVE-2026-51081
CVE-2026-51081 is an XSS vulnerability affecting Proxmox Virtual Environment (PVE) 9.x 5.1.8 and PVE 8.x 4.3.16. The issue allows attackers to inject and execute arbitrary web scripts or HTML via a crafted payload, enabling client-side code execution in affected web interfaces. The public documen...
CVE-2026-51082
A race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment PVE 9.x pve-manager before 9.1.9 and 8.x before 8.4.19; qemu-server 9.x before 9.1.7 and 8.x before 8.4.7; and pve-container before 6.1.3 PVE 9.x and before 5.3.4 PVE 8.x allows an attacker with...
homelab-security
Cybersecurity Home Lab A personal home lab built for hands-on...
Terraform / OpenTofu Provider for Proxmox VE 安全漏洞
Terraform/OpenTofu Provider for Proxmox VE is a software developed by Pavel Boldyrev. Versions of Terraform/OpenTofu Provider for Proxmox VE prior to 0.93.1 contained security vulnerabilities. These vulnerabilities stemmed from insecure sudoer lines in the SSH configuration files, which could lea...
EUVD-2014-4087
Malware in sbrugna...
EUVD-2025-27408
Malicious code in bioql PyPI...
Fixing Restore Failures Due to QEMU Machine Version
Challenge When attempting to restore a VM with a QEMU version lower than 10 and disks in QCOW2 format to a Proxmox VE v9 node, the following error occurs: 16.09.2025 10:25:28 Error Linux-8.0 : Failed to reach the hypervisor. Error output: storage for 'local-LVM:vm-42-disk-1.qcow2' is configured...
CVE-2025-57539
A stored cross-site scripting XSS vulnerability in the U2F Origin field of the Datacenter configuration in Proxmox Virtual Environment PVE 8.4 allows authenticated users to store malicious input. The payload is rendered unsafely in the Web UI and executed when viewed by other users, potentially...
CVE-2025-57540
A stored cross-site scripting XSS vulnerability exists in the WebAuthn Relying Party field within the Datacenter configuration of Proxmox Virtual Environment PVE 8.4. Authenticated users can inject JavaScript code that is later executed in the browsers of users who view the configuration page,...
CVE-2025-57539
A stored cross-site scripting XSS vulnerability in the U2F Origin field of the Datacenter configuration in Proxmox Virtual Environment PVE 8.4 allows authenticated users to store malicious input. The payload is rendered unsafely in the Web UI and executed when viewed by other users, potentially...
PT-2025-36794
Name of the Vulnerable Software and Affected Versions: Proxmox Virtual Environment version 8.4 Description: A stored cross-site scripting XSS issue exists in the WebAuthn Relying Party field within the Datacenter configuration. Authenticated users can inject JavaScript code that is later executed...
CVE-2014-4156
Proxmox VE prior to 3.2: 'AccessControl.pm' User Enumeration Vulnerability...
Build Numbers and Versions of Veeam Plug-in for Proxmox VE
This KB article lists all versions of the Veeam Plug-in for Proxmox VE and their respective worker build numbers. Version | Plug-in Build | Worker Build | Release Date ---|---|---|--- Veeam Plug-in for Proxmox VE 4 Releases Veeam Plug-in for Proxmox VE 4.0 Included with Veeam Backup & Replication...
"Failed to convert [Not Settable] to UUID."
Challenge Veeam Backup & Replication task interacting with Proxmox VE host fails with: Failed to convert Not Settable to UUID Cause This occurs when the Proxmox VE host has an empty bios UUID, or the reported bios UUID value is unparsable. Solution 1. Remove workers if any from the Veeam Backup &...
Proxmox VE 7.4-1 TOTP Brute Force
Exploit Title: Proxmox VE TOTP Brute Force Date: 09/23/2023 Exploit Author: Cory Cline, Gabe Rust Vendor Homepage: https://www.proxmox.com/en/ Software Link: http://download.proxmox.com/iso/ Version: 5.4 - 7.4-1 Tested on: Debian CVE : CVE-2023-43320 import time import requests import urllib.pars...
Proxmox VE - TOTP Brute Force
Exploit Title: Proxmox VE TOTP Brute Force Date: 09/23/2023 Exploit Author: Cory Cline, Gabe Rust Vendor Homepage: https://www.proxmox.com/en/ Software Link: http://download.proxmox.com/iso/ Version: 5.4 - 7.4-1 Tested on: Debian CVE : CVE-2023-43320 import time import requests import urllib.pars...
Proxmox VE - TOTP Brute Force Exploit
Exploit Title: Proxmox VE TOTP Brute Force Exploit Author: Cory Cline, Gabe Rust Vendor Homepage: https://www.proxmox.com/en/ Software Link: http://download.proxmox.com/iso/ Version: 5.4 - 7.4-1 Tested on: Debian CVE : CVE-2023-43320 import time import requests import urllib.parse import json...
CVE-2014-4156
Proxmox VE prior to 3.2: 'AccessControl.pm' User Enumeration Vulnerability...
