CVE-2024-21545-PoC

CVE-2024-21545-PoC Proxmox VE 任意文件读取 - 完全系统沦陷。尚未测试...本周将进行测试。...

CVE-2026-PSA-2026-00043-1

PSA-2026-00043-1 CVE-2026-PSA-2026-00043-1 Proxmox VE 7.0–8.0.3: unauthenticated, single-request root auth bypass Donate...

Proxmox VE - Default Credentials with TFA Bypass

Detected Proxmox VE was accessible using default root@pam credentials combined with a TFA challenge bypass. An attacker could authenticate as root by submitting the default password "root@pam" along with a crafted tfa-challenge parameter, thereby bypassing two-factor authentication enforcement an...

EUVD-2023-60613

Proxmox Virtual Environment VE 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value ...

CVE-2023-54391 Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter

Proxmox Virtual Environment VE 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value ...

CVE-2023-54391 Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter

Proxmox Virtual Environment VE 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value ...

CVE-2023-54391

Proxmox Virtual Environment (VE) 7.0 through 8.0 contains a critical authentication bypass in libpve-access-control before 8.0.4 . By supplying an arbitrary value in the tfa-challenge parameter of the access ticket API endpoint, unauthenticated attackers can skip password verification entirely an...

PT-2026-84529

Name of the Vulnerable Software and Affected Versions Proxmox Virtual Environment VE versions 7.0 through 8.0 Description An authentication bypass exists in libpve-access-control that allows unauthenticated attackers to authenticate as any enabled user who does not have a second factor configured...

VulnCheck KEV: CVE-2023-54391

Proxmox Virtual Environment VE 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value ...

CVE-2026-51082

A race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment PVE 9.x pve-manager before 9.1.9 and 8.x before 8.4.19; qemu-server 9.x before 9.1.7 and 8.x before 8.4.7; and pve-container before 6.1.3 PVE 9.x and before 5.3.4 PVE 8.x allows an attacker with...

CVE-2026-51081

CVE-2026-51081 is an XSS vulnerability affecting Proxmox Virtual Environment (PVE) 9.x 5.1.8 and PVE 8.x 4.3.16. The issue allows attackers to inject and execute arbitrary web scripts or HTML via a crafted payload, enabling client-side code execution in affected web interfaces. The public documen...

homelab-security

Cybersecurity Home Lab A personal home lab built for hands-on...

Terraform / OpenTofu Provider for Proxmox VE 安全漏洞

Terraform/OpenTofu Provider for Proxmox VE is a software developed by Pavel Boldyrev. Versions of Terraform/OpenTofu Provider for Proxmox VE prior to 0.93.1 contained security vulnerabilities. These vulnerabilities stemmed from insecure sudoer lines in the SSH configuration files, which could lea...

EUVD-2014-4087

Malware in sbrugna...

EUVD-2025-27408

Malicious code in bioql PyPI...

Fixing Restore Failures Due to QEMU Machine Version

Challenge When attempting to restore a VM with a QEMU version lower than 10 and disks in QCOW2 format to a Proxmox VE v9 node, the following error occurs: 16.09.2025 10:25:28 Error Linux-8.0 : Failed to reach the hypervisor. Error output: storage for 'local-LVM:vm-42-disk-1.qcow2' is configured...

CVE-2025-57539

A stored cross-site scripting XSS vulnerability in the U2F Origin field of the Datacenter configuration in Proxmox Virtual Environment PVE 8.4 allows authenticated users to store malicious input. The payload is rendered unsafely in the Web UI and executed when viewed by other users, potentially...

CVE-2025-57539

A stored cross-site scripting XSS vulnerability in the U2F Origin field of the Datacenter configuration in Proxmox Virtual Environment PVE 8.4 allows authenticated users to store malicious input. The payload is rendered unsafely in the Web UI and executed when viewed by other users, potentially...

CVE-2025-57540

A stored cross-site scripting XSS vulnerability exists in the WebAuthn Relying Party field within the Datacenter configuration of Proxmox Virtual Environment PVE 8.4. Authenticated users can inject JavaScript code that is later executed in the browsers of users who view the configuration page,...

PT-2025-36794

Name of the Vulnerable Software and Affected Versions: Proxmox Virtual Environment version 8.4 Description: A stored cross-site scripting XSS issue exists in the WebAuthn Relying Party field within the Datacenter configuration. Authenticated users can inject JavaScript code that is later executed...