CVE-2022-31358

CVE-2022-31358 is a reflected XSS in Proxmox Virtual Environment before v7.2-3. The issue allows remote attackers to execute arbitrary web scripts/HTML by accessing non-existent endpoints under /api2/html/. Affected software: Proxmox VE versions prior to 7.2-3. Root cause/impact: reflected XSS wi...

CVE-2022-35508

Proxmox CVE-2022-35508 enables SSRF when proxying HTTP requests between pve(pmg)proxy and pve(pmg)daemon, exploitable by an unprivileged user to disclose server files. In Proxmox Mail Gateway, there is also a privilege escalation route to root@pam if backup artifacts were used, because pmg-backup...

CVE-2023-43320

Affected products and versions: Proxmox VE 5.4–8.0, Proxmox Backup Server 1.1–3.0, and Proxmox Mail Gateway 7.1–8.0. Vulnerability: remote authenticated attacker can escalate privileges by bypassing the two‑factor authentication component. Root cause/impact: authentication bypass enabling privile...

CVE-2022-35507

Proxmox VE/PMG web interfaces are affected by a response-header CRLF injection in pve-http-server. An attacker can cause a client-side DoS by injecting CRLF into response headers to set cookies longer than the server expects, notably affecting Chromium-based browsers using %0d. Affected versions ...

CVE-2014-4156

Proxmox VE prior to 3.2 has a User Enumeration vulnerability in AccessControl.pm . The issue is described across sources (NVD, RH, CVE registries) as a vulnerability affecting Proxmox VE before version 3.2, named “AccessControl.pm User Enumeration Vulnerability.” Public references note a moderate...

CVE-2025-57540

A stored cross-site scripting (XSS) vulnerability exists in the WebAuthn Relying Party field within the Datacenter configuration of Proxmox Virtual Environment (PVE) 8.4 . Authenticated users can inject malicious JavaScript code that executes in the browsers of other users viewing the configurati...

CVE-2025-57539

A stored cross-site scripting (XSS) vulnerability exists in the U2F Origin field of the Datacenter configuration in Proxmox Virtual Environment (PVE) 8.4 . Authenticated users can store malicious input that is rendered unsafely in the Web UI , leading to execution when viewed by other users. This...

CVE-2025-57538

Proxmox Virtual Environment (PVE ) version 8.4 is susceptible to a stored cross-site scripting (XSS) vulnerability within the HTTP Proxy field of the Datacenter configuration panel . An authenticated user can inject malicious input that is stored and subsequently executed in the browsers of other...