Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
12 results
Feb 7, 2023Directory Traversal vulnerability in AdminLTE 3.1.0 allows remote attackers to gain escalated privilege and view sensitive information via /admin/index2.html, /CVE-2021-36471 · Other software · Adminlte.io · reported by MITRECritical 9.8
Directory Traversal vulnerability in AdminLTE 3.1.0 allows remote attackers to gain escalated privilege and view sensitive information via /admin/index2.html, /admin/index3.html URIs. Note: AdminLTE developers dispute that this a weakness with AdminLTE and is instead a misconfiguration error on various websites by the website developers.
- Product
- Adminlte
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jan 26, 2023Pi-hole®'s Web interface (based off of AdminLTE) provides a central location to manage your Pi-hole.CVE-2023-23614 · Other software · pi-hole · reported by GitHubHigh 8.8
Pi-hole®'s Web interface (based off of AdminLTE) provides a central location to manage your Pi-hole. Versions 4.0 and above, prior to 5.18.3 are vulnerable to Insufficient Session Expiration. Improper use of admin WEBPASSWORD hash as "Remember me for 7 days" cookie value makes it possible for an attacker to "pass the hash" to login or reuse a theoretically expired "remember me" cookie. It also exposes the hash over the network and stores it unnecessarily in the browser. The cookie itself is set to expire after 7 days but its value will remain valid as long as the admin password doesn't change. If a cookie is leaked or compromised it could be used forever as long as the admin password is not changed. An attacker that obtained the password hash via an other attack vector (for example a path traversal vulnerability) could use it to login as the admin by setting the hash as the cookie value without the need to crack it to obtain the admin password (pass the hash). The hash is exposed over the network and in the browser where the cookie is transmitted and stored. This issue is patched in version 5.18.3.
- Product
- AdminLTE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2022Pi-Hole is a network-wide ad blocking via your own Linux hardware, AdminLTE is a Pi-hole Dashboard for stats and more.CVE-2022-23513 · Other software · pi-hole · reported by GitHubMedium 5.3
Pi-Hole is a network-wide ad blocking via your own Linux hardware, AdminLTE is a Pi-hole Dashboard for stats and more. In case of an attack, the threat actor will obtain the ability to perform an unauthorized query for blocked domains on `queryads` endpoint. In the case of application, this vulnerability exists because of a lack of validation in code on a root server path: `/admin/scripts/pi-hole/phpqueryads.php.` Potential threat actor(s) are able to perform an unauthorized query search in blocked domain lists. This could lead to the disclosure for any victims' personal blacklists.
- Product
- AdminLTE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jul 7, 2022AdminLTE is a Pi-hole Dashboard for stats and configuration.CVE-2022-31029 · Other software · pi-hole · reported by GitHubMedium 5.9
AdminLTE is a Pi-hole Dashboard for stats and configuration. In affected versions inserting code like `<script>alert("XSS")</script>` in the field marked with "Domain to look for" and hitting <kbd>enter</kbd> (or clicking on any of the buttons) will execute the script. The user must be logged in to use this vulnerability. Usually only administrators have login access to pi-hole, minimizing the risks. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- AdminLTE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2021Pi-hole's Web interface (based on AdminLTE) provides a central location to manage one's Pi-hole and review the statistics generated by FTLDNS.CVE-2021-41175 · Other software · pi-hole · reported by GitHubHigh 7.3
Pi-hole's Web interface (based on AdminLTE) provides a central location to manage one's Pi-hole and review the statistics generated by FTLDNS. Prior to version 5.8, cross-site scripting is possible when adding a client via the groups-clients management page. This issue was patched in version 5.8.
- Product
- AdminLTE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2021adminlte is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-3812 · Other software · pi-hole · reported by security@huntr.devMedium 6.1
adminlte is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- pi-hole/adminlte
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2021adminlte is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-3811 · Other software · pi-hole · reported by security@huntr.devMedium 6.1
adminlte is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- pi-hole/adminlte
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2021adminlte is vulnerable to Sensitive Cookie Without 'HttpOnly' FlagCVE-2021-3706 · Other software · pi-hole · reported by security@huntr.devHigh 7.5
adminlte is vulnerable to Sensitive Cookie Without 'HttpOnly' Flag
- Product
- pi-hole/adminlte
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2021Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics.CVE-2021-32793 · Other software · pi-hole · reported by GitHubMedium 5.7
Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5.1, the function to add domains to blocklists or allowlists is vulnerable to a stored cross-site-scripting vulnerability. User input added as a wildcard domain to a blocklist or allowlist is unfiltered in the web interface. Since the payload is stored permanently as a wildcard domain, this is a persistent XSS vulnerability. A remote attacker can therefore attack administrative user accounts through client-side attacks. Pi-hole Web Interface version 5.5.1 contains a patch for this vulnerability.
- Product
- AdminLTE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2021Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics.CVE-2021-32706 · Other software · pi-hole · reported by GitHubHigh 7.6
Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5.1, the `validDomainWildcard` preg_match filter allows a malicious character through that can be used to execute code, list directories, and overwrite sensitive files. The issue lies in the fact that one of the periods is not escaped, allowing any character to be used in its place. A patch for this vulnerability was released in version 5.5.1.
- Product
- AdminLTE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2021Pi-hole is a Linux network-level advertisement and Internet tracker blocking application.CVE-2021-29448 · Other software · pi-hole · reported by GitHubHigh 7.6
Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. The Stored XSS exists in the Pi-hole Admin portal, which can be exploited by the malicious actor with the network access to DNS server. See the referenced GitHub security advisory for patch details.
- Product
- AdminLTE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2020Pi-Hole AdminLTE Remote Code Execution VulnerabilityCVE-2020-8816 · Other software · Pi-hole · reported by MITREExploitedHigh 7.2
Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.
- Product
- AdminLTE
- On CISA’s list since
- Dec 10, 2021 (federal fix deadline Jun 10, 2022)
- What to do
- Attackers are using this now. Install Pi-hole’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.compacketstormsecurity.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.