CVE-2025-57540: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability exists in the WebAuthn Relying Party field within the Datacenter configuration of Proxmox Virtual Environment PVE 8.4. Authenticated users can inject JavaScript code that is later executed in the browsers of users who view the configuration page,...

CVE-2025-57539: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in the U2F Origin field of the Datacenter configuration in Proxmox Virtual Environment PVE 8.4 allows authenticated users to store malicious input. The payload is rendered unsafely in the Web UI and executed when viewed by other users, potentially...

CVE-2025-57538

Proxmox Virtual Environment (PVE ) version 8.4 is susceptible to a stored cross-site scripting (XSS) vulnerability within the HTTP Proxy field of the Datacenter configuration panel . An authenticated user can inject malicious input that is stored and subsequently executed in the browsers of other...

CVE-2025-57540

A stored cross-site scripting XSS vulnerability exists in the WebAuthn Relying Party field within the Datacenter configuration of Proxmox Virtual Environment PVE 8.4. Authenticated users can inject JavaScript code that is later executed in the browsers of users who view the configuration page,...

PT-2025-36794

Name of the Vulnerable Software and Affected Versions: Proxmox Virtual Environment version 8.4 Description: A stored cross-site scripting XSS issue exists in the WebAuthn Relying Party field within the Datacenter configuration. Authenticated users can inject JavaScript code that is later executed...

Proxmox Virtual Environment 安全漏洞

Proxmox Virtual Environment Proxmox VE is an open source server virtualization environment Linux distribution from Proxmox. A security vulnerability exists in Proxmox Virtual Environment version 8.4, which stems from a U2F Origin field stored cross-site scripting vulnerability that could lead to...

CVE-2025-57540

A stored cross-site scripting (XSS) vulnerability exists in the WebAuthn Relying Party field within the Datacenter configuration of Proxmox Virtual Environment (PVE) 8.4 . Authenticated users can inject malicious JavaScript code that executes in the browsers of other users viewing the configurati...

Could not apply snapshot: Device has active dirty bitmaps

Challenge When the user attempts to use the Rollback function for a snapshot on a Proxmox Virtual Environment PVE Virtual Machine VM that is protected by Veeam Backup & Replication, the following error occurs: qemu-img: Could not apply snapshot '%%': Device has active dirty bitmaps Cause This err...

CVE-2022-28144

Jenkins Proxmox Plugin 0.7.0 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified host using attacker-specified username and password perform a connection test, disable SSL/TLS validation for...

CVE-2022-28143

A cross-site request forgery CSRF vulnerability in Jenkins Proxmox Plugin 0.7.0 and earlier allows attackers to connect to an attacker-specified host using attacker-specified username and password perform a connection test, disable SSL/TLS validation for the entire Jenkins controller JVM as part ...

CVE-2022-28142

Jenkins Proxmox Plugin 0.6.0 and earlier disables SSL/TLS certificate validation globally for the Jenkins controller JVM when configured to ignore SSL/TLS issues...

CVE-2022-28141

Jenkins Proxmox Plugin 0.5.0 and earlier stores the Proxmox Datacenter password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system...

CVE-2014-4156

Proxmox VE prior to 3.2: 'AccessControl.pm' User Enumeration Vulnerability...

Build Numbers and Versions of Veeam Plug-In for Proxmox VE

This KB article lists all versions of the Veeam Plug-In for Proxmox VE and their respective worker build numbers. Version | Plug-In Build | Worker Build | Release Date ---|---|---|--- Veeam Plug-In for Proxmox VE 4 Releases Veeam Plug-In for Proxmox VE 4.0 Included with Veeam Backup & Replication...

Granular sudo Permissions for Veeam Plug-in for Proxmox VE

Purpose This article provides an example granular 'sudoers' configuration for the Linux account that will be used by Veeam Backup & Replication when managing a Proxmox VE host. Solution Critical Details Before You Begin Review all Considerations and Limitations in the user guide! Most noteworthy:...

Release Information for Proxmox Virtual Environment Plug-In v12.1.3.217

Update: 2025-03-19 Consider the following regarding the Proxmox Virtual Environment Plug-In: The Plug-in build on this page, 12.1.3.217, is included automatically when upgrading to or installing Veeam Backup & Replication 12.3.1. The Plug-in only needs to be manually deployed by customers still...

CVE-2024-21545

Proxmox Virtual Environment is an open-source server management platform for enterprise virtualization. Insufficient safeguards against malicious API response values allow authenticated attackers with 'Sys.Audit' or 'VM.Monitor' privileges to download arbitrary host files via the API. When handli...

Backup of Powered-Off VM in Proxmox Fails When HA Status is Stopped

Challenge The backup of a powered-off VM within a Proxmox environment where High Availability HA is enabled but the HA status is Stopped , fails with the error: Failed to perform backup: Failed to connect the NBD server to the hypervisor host. Cause The job fails because the High Availability HA...

The vulnerability of the handle_api2_request() function in the Proxmox Virtual Environment platform’s interface, as well as the Proxmox Mail Gateway email protection mechanism, allows a perpetrator to gain access to read, modify, or delete data.

The vulnerability of the handleapi2request function in the Proxmox Virtual Environment platform’s interface, along with the Proxmox Mail Gateway email protection mechanism, is related to improper external management of file names or paths when processing objects like “download” or “data-download”...

"Failed to convert [Not Settable] to UUID."

Challenge Veeam Backup & Replication task interacting with Proxmox VE host fails with: Failed to convert Not Settable to UUID Cause This occurs when the Proxmox VE host has an empty bios UUID, or the reported bios UUID value is unparsable. Solution 1. Remove workers if any from the Veeam Backup &...