Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
45 results
Jul 14, 2026Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software.CVE-2026-50130 · Other software · pi-hole · reported by GitHubHigh 8.8
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to 6.4.2, a user with code execution as the unprivileged pihole user can escalate to root by replacing /etc/pihole/logrotate. The replacement is laundered to root:root ownership by pihole-FTL-prestart.sh and then parsed as root by the daily pihole flush cron, executing firstaction shell as uid 0. This issue is fixed in version 6.4.3.
- Product
- pi-hole
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker.CVE-2026-44693 · Other software · pi-hole · reported by GitHubHigh 8.8
Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker. Prior to version 6.6.1, Pi-hole FTL contains a race condition vulnerability in the HTTP session management subsystem, introduced with the v6.0 rewrite of the embedded CivetWeb-based web server. This issue has been patched in version 6.6.1.
- Product
- FTL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software.CVE-2026-41489 · Other software · pi-hole · reported by GitHubHigh 8.8
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to before Core 6.4.2 and FTL 6.6.1, two shell scripts executed as root by systemd (pihole-FTL-prestart.sh and pihole-FTL-poststop.sh) read the files.pid path from this config without validation and use it in privileged file operations (install and rm -f). By writing an arbitrary path into files.pid, an attacker with pihole privilege can cause root to delete and then recreate any file on the system outside the ProtectSystem=full-restricted directories, gaining write access to it. On a default Pi-hole installation this yields local privilege escalation to root via SSH authorized keys manipulation. If /root/.ssh/authorized_keys does not exist (default on fresh installs), only ExecStartPre is required. If the file exists, ExecStopPost deletes it first, and the same restart triggers both hooks in sequence. This vulnerability is fixed in Core 6.4.2 and FTL 6.6.1.
- Product
- pi-hole
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2026Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker.CVE-2026-39849 · Other software · pi-hole · reported by GitHubHigh 8.7
Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker. In versions before 6.6.1, the `dns.interface` configuration field in Pi-hole FTL accepted newline characters without validation, allowing an attacker to inject arbitrary directives into the generated dnsmasq configuration file. On installations with no admin password set (the default for many deployments), the configuration API is fully accessible without credentials, allowing a network-adjacent attacker to inject the payload, enable the built-in DHCP server, and achieve arbitrary command execution on the host the next time any device on the network requests a DHCP lease. The injected value is persisted to /etc/pihole/pihole.toml and survives restarts. The strncpy in the code path limits the total interface field to 31 bytes, but payloads such as wlan0\ndhcp-script=/tmp/p fit within this constraint. The dnsmasq config validation introduced in FTL 6.6 only checks syntactic validity, so valid directives injected via newline pass validation successfully. This issue has been fixed in version 6.6.1.
- Product
- FTL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface.CVE-2026-35521 · Other software · pi-hole · reported by GitHubHigh 8.8
FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DHCP hosts configuration parameter (dhcp.hosts). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6.
- Product
- FTL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface.CVE-2026-35520 · Other software · pi-hole · reported by GitHubHigh 8.8
FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DHCP lease time configuration parameter (dhcp.leaseTime). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6.
- Product
- FTL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface.CVE-2026-35519 · Other software · pi-hole · reported by GitHubHigh 8.8
FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DNS host record configuration parameter (dns.hostRecord). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6.
- Product
- FTL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface.CVE-2026-35518 · Other software · pi-hole · reported by GitHubHigh 8.8
FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DNS CNAME records configuration parameter (dns.cnameRecords). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6.
- Product
- FTL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface.CVE-2026-35517 · Other software · pi-hole · reported by GitHubHigh 8.8
FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the upstream DNS servers configuration parameter (dns.upstreams). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6.
- Product
- FTL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface.CVE-2026-35491 · Other software · pi-hole · reported by GitHubMedium 6.1
FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, Pi-hole FTL supports a CLI password feature (webserver.api.cli_pw) that creates “CLI” API sessions intended to be read-only for configuration changes. While /api/config correctly blocks CLI sessions from mutating configuration, /api/teleporter allowed Teleporter imports for CLI sessions, enabling a CLI-scoped session to overwrite configuration via a Teleporter archive (authorization bypass). This vulnerability is fixed in 6.6.
- Product
- FTL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Pi-hole is a Linux network-level advertisement and Internet tracker blocking application.CVE-2026-33727 · Other software · pi-hole · reported by GitHubMedium 6.4
Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Version 6.4 has a local privilege-escalation vulnerability allows code execution as root from the low-privilege pihole account. Important context: the pihole account uses nologin, so this is not a direct interactive-login issue. However, nologin does not prevent code from running as UID pihole if a Pi-hole component is compromised. In that realistic post-compromise scenario, attacker-controlled content in /etc/pihole/versions is sourced by root-run Pi-hole scripts, leading to root code execution. This vulnerability is fixed in 6.4.1.
- Product
- pi-hole
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application.CVE-2026-33405 · Other software · pi-hole · reported by GitHubLow 3.1
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, the formatInfo() function in queries.js renders data.upstream, data.client.ip, and data.ede.text into HTML without escaping when a user expands a query row in the Query Log, enabling stored HTML injection. JavaScript execution is blocked by the server's CSP (script-src 'self'). The same fields are properly escaped in the table view (rowCallback), confirming the omission was an oversight. This vulnerability is fixed in 6.5.
- Product
- web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application.CVE-2026-33406 · Other software · pi-hole · reported by GitHubMedium 5.4
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, configuration values from the /api/config endpoint are placed directly into HTML value="" attributes without escaping in settings-advanced.js, enabling HTML attribute injection. A double quote in any config value breaks out of the attribute context. JavaScript execution is blocked by the server's CSP (script-src 'self'), but injected attributes can alter element styling for UI redressing. The primary attack vector is importing a malicious teleporter backup, which bypasses per-field server-side validation. This vulnerability is fixed in 6.5.
- Product
- web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application.CVE-2026-33404 · Other software · pi-hole · reported by GitHubLow 3.4
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, client hostnames and IP addresses from the FTL database are rendered into the DOM without escaping in network.js (Network page) and charts.js/index.js (Dashboard chart tooltips). While upstream validation in dnsmasq and FTL blocks HTML characters via normal DHCP/DNS paths, the web UI performs no output escaping — an inconsistency with other fields in the same file that are properly escaped. This vulnerability is fixed in 6.5.
- Product
- web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application.CVE-2026-33403 · Other software · pi-hole · reported by GitHubMedium 6.1
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, a reflected DOM-based XSS vulnerability in taillog.js allows an unauthenticated attacker to inject arbitrary HTML into the Pi-hole admin interface by crafting a malicious URL. The file query parameter is interpolated into an innerHTML assignment without escaping. Because the Content-Security-Policy is missing the form-action directive, injected <form> elements can exfiltrate credentials to an external origin. This vulnerability is fixed in 6.5.
- Product
- web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2026Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application.CVE-2026-33765 · Other software · pi-hole · reported by GitHubHigh 8.9
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. Versions prior to 6.0 have a critical OS Command Injection vulnerability in the savesettings.php file. The application takes the user-controlled $_POST['webtheme'] parameter and concatenates it directly into a system command executed via PHP's exec() function. Since the input is neither sanitized nor validated before being passed to the shell, an attacker can append arbitrary system commands to the intended pihole command. Furthermore, because the command is executed with sudo privileges, the injected commands will run with elevated (likely root) privileges. Version 6.0 patches the issue.
- Product
- web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application.CVE-2026-26953 · Other software · pi-hole · reported by GitHubMedium 5.4
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. Versions 6.0 and above have a Stored HTML Injection vulnerability in the active sessions table located on the API settings page, allowing an attacker with valid credentials to inject arbitrary HTML code that will be rendered in the browser of any administrator who visits the active sessions page. The rowCallback function contains the value data.x_forwarded_for, which is directly concatenated into an HTML string and inserted into the DOM using jQuery’s .html() method. This method interprets the content as HTML, which means that any HTML tags present in the value will be parsed and rendered by the browser. An attacker can use common tools such as curl, wget, Python requests, Burp Suite, or even JavaScript fetch() to send an authentication request with an X-Forwarded-For header that contains malicious HTML code instead of a legitimate IP address. Since Pi-hole implements a Content Security Policy (CSP) that blocks inline JavaScript, the impact is limited to pure HTML injection without the ability to execute scripts. This issue has been fixed in version 6.4.1.
- Product
- web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application.CVE-2026-26952 · Other software · pi-hole · reported by GitHubMedium 5.4
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. Versions 6.4 and below are vulnerable to stored HTML injection through the local DNS records configuration page, which allows an authenticated administrator to inject code that is stored in the Pi-hole configuration and rendered every time the DNS records table is viewed. The populateDataTable() function contains a data variable with the full DNS record value exactly as entered by the user and returned by the API. This value is inserted directly into the data-tag HTML attribute without any escaping or sanitization of special characters. When an attacker supplies a value containing double quotes ("), they can prematurely “close” the data-tag attribute and inject additional HTML attributes into the element. Since Pi-hole implements a Content Security Policy (CSP) that blocks inline JavaScript, the impact is limited. This issue has been fixed in version 6.4.1.
- Product
- web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application.CVE-2025-59151 · Other software · pi-hole · reported by GitHubHigh 8.2
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interface before 6.3 is vulnerable to Carriage Return Line Feed (CRLF) injection. When a request is made to a file ending with the .lp extension, the application performs a redirect without properly sanitizing the input. An attacker can inject carriage return and line feed characters (%0d%0a) to manipulate both the headers and the content of the HTTP response. This enables the injection of arbitrary HTTP response headers, potentially leading to session fixation, cache poisoning, and the weakening or bypassing of browser-based security mechanisms such as Content Security Policy or X-XSS-Protection. This vulnerability is fixed in 6.3.
- Product
- web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application.CVE-2025-53533 · Other software · pi-hole · reported by GitHubMedium 5.1
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interface versions 6.2.1 and earlier are vulnerable to reflected cross-site scripting (XSS) via a malformed URL path. The 404 error page includes the requested path in the class attribute of the body tag without proper sanitization or escaping. An attacker can craft a URL containing an onload attribute that will execute arbitrary JavaScript code in the browser when a victim visits the malicious link. If an attacker sends a crafted pi-hole link to a victim and the victim visits it, attacker-controlled JavaScript code is executed in the browser of the victim. This has been patched in version 6.3.
- Product
- web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application.CVE-2025-32785 · Other software · pi-hole · reported by GitHubLow 2
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interface versions prior to 6.3 are vulnerable to cross-site scripting (XSS) via the Address field in the Subscribed Lists group management section. An authenticated user can inject malicious JavaScript by adding a payload to the Address field when creating or editing a list entry. The vulnerability is triggered when another user navigates to the Tools section and performs a gravity database update. The Address field does not properly sanitize input, allowing special characters and script tags to bypass validation. This has been patched in version 6.3.
- Product
- web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2025An authenticated command injection vulnerability exists in Pi-hole versions up to 3.3.CVE-2025-34087 · Other software · Pi-hole LLC · reported by VulnCheckCritical 9
An authenticated command injection vulnerability exists in Pi-hole versions up to 3.3. When adding a domain to the allowlist via the web interface, the domain parameter is not properly sanitized, allowing an attacker to append OS commands to the domain string. These commands are executed on the underlying operating system with the privileges of the Pi-hole service user. This behavior was present in the legacy AdminLTE interface and has since been patched in later versions.
- Product
- Web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2024Pi-hole before 6 allows unauthenticated admin/api.php?setTempUnit= calls to change the temperature units of the web dashboard.CVE-2024-44069 · Other software · Pi-hole · reported by MITREHigh 7.5
Pi-hole before 6 allows unauthenticated admin/api.php?setTempUnit= calls to change the temperature units of the web dashboard. NOTE: the supplier reportedly does "not consider the bug a security issue" but the specific motivation for letting arbitrary persons change the value (Celsius, Fahrenheit, or Kelvin), seen by the device owner, is unclear.
- Product
- Pi-hole
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2024Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software.CVE-2024-34361 · Other software · pi-hole · reported by GitHubHigh 8.5
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. A vulnerability in versions prior to 5.18.3 allows an authenticated user to make internal requests to the server via the `gravity_DownloadBlocklistFromUrl()` function. Depending on some circumstances, the vulnerability could lead to remote command execution. Version 5.18.3 contains a patch for this issue.
- Product
- pi-hole
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2024The Pi-hole is a DNS sinkhole that protects your devices from unwanted content without installing any client-side software.CVE-2024-28247 · Other software · pi-hole · reported by GitHubHigh 7.6
The Pi-hole is a DNS sinkhole that protects your devices from unwanted content without installing any client-side software. A vulnerability has been discovered in Pihole that allows an authenticated user on the platform to read internal server files arbitrarily, and because the application runs from behind, reading files is done as a privileged user.If the URL that is in the list of "Adslists" begins with "file*" it is understood that it is updating from a local file, on the other hand if it does not begin with "file*" depending on the state of the response it does one thing or another. The problem resides in the update through local files. When updating from a file which contains non-domain lines, 5 of the non-domain lines are printed on the screen, so if you provide it with any file on the server which contains non-domain lines it will print them on the screen. This vulnerability is fixed by 5.18.
- Product
- pi-hole
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023Pi-hole®'s Web interface (based off of AdminLTE) provides a central location to manage your Pi-hole.CVE-2023-23614 · Other software · pi-hole · reported by GitHubHigh 8.8
Pi-hole®'s Web interface (based off of AdminLTE) provides a central location to manage your Pi-hole. Versions 4.0 and above, prior to 5.18.3 are vulnerable to Insufficient Session Expiration. Improper use of admin WEBPASSWORD hash as "Remember me for 7 days" cookie value makes it possible for an attacker to "pass the hash" to login or reuse a theoretically expired "remember me" cookie. It also exposes the hash over the network and stores it unnecessarily in the browser. The cookie itself is set to expire after 7 days but its value will remain valid as long as the admin password doesn't change. If a cookie is leaked or compromised it could be used forever as long as the admin password is not changed. An attacker that obtained the password hash via an other attack vector (for example a path traversal vulnerability) could use it to login as the admin by setting the hash as the cookie value without the need to crack it to obtain the admin password (pass the hash). The hash is exposed over the network and in the browser where the cookie is transmitted and stored. This issue is patched in version 5.18.3.
- Product
- AdminLTE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2022Pi-Hole is a network-wide ad blocking via your own Linux hardware, AdminLTE is a Pi-hole Dashboard for stats and more.CVE-2022-23513 · Other software · pi-hole · reported by GitHubMedium 5.3
Pi-Hole is a network-wide ad blocking via your own Linux hardware, AdminLTE is a Pi-hole Dashboard for stats and more. In case of an attack, the threat actor will obtain the ability to perform an unauthorized query for blocked domains on `queryads` endpoint. In the case of application, this vulnerability exists because of a lack of validation in code on a root server path: `/admin/scripts/pi-hole/phpqueryads.php.` Potential threat actor(s) are able to perform an unauthorized query search in blocked domain lists. This could lead to the disclosure for any victims' personal blacklists.
- Product
- AdminLTE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jul 7, 2022AdminLTE is a Pi-hole Dashboard for stats and configuration.CVE-2022-31029 · Other software · pi-hole · reported by GitHubMedium 5.9
AdminLTE is a Pi-hole Dashboard for stats and configuration. In affected versions inserting code like `<script>alert("XSS")</script>` in the field marked with "Domain to look for" and hitting <kbd>enter</kbd> (or clicking on any of the buttons) will execute the script. The user must be logged in to use this vulnerability. Usually only administrators have login access to pi-hole, minimizing the risks. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- AdminLTE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2021Pi-hole's Web interface (based on AdminLTE) provides a central location to manage one's Pi-hole and review the statistics generated by FTLDNS.CVE-2021-41175 · Other software · pi-hole · reported by GitHubHigh 7.3
Pi-hole's Web interface (based on AdminLTE) provides a central location to manage one's Pi-hole and review the statistics generated by FTLDNS. Prior to version 5.8, cross-site scripting is possible when adding a client via the groups-clients management page. This issue was patched in version 5.8.
- Product
- AdminLTE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2021adminlte is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-3812 · Other software · pi-hole · reported by security@huntr.devMedium 6.1
adminlte is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- pi-hole/adminlte
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2021adminlte is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-3811 · Other software · pi-hole · reported by security@huntr.devMedium 6.1
adminlte is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- pi-hole/adminlte
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2021adminlte is vulnerable to Sensitive Cookie Without 'HttpOnly' FlagCVE-2021-3706 · Other software · pi-hole · reported by security@huntr.devHigh 7.5
adminlte is vulnerable to Sensitive Cookie Without 'HttpOnly' Flag
- Product
- pi-hole/adminlte
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2021Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics.CVE-2021-32793 · Other software · pi-hole · reported by GitHubMedium 5.7
Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5.1, the function to add domains to blocklists or allowlists is vulnerable to a stored cross-site-scripting vulnerability. User input added as a wildcard domain to a blocklist or allowlist is unfiltered in the web interface. Since the payload is stored permanently as a wildcard domain, this is a persistent XSS vulnerability. A remote attacker can therefore attack administrative user accounts through client-side attacks. Pi-hole Web Interface version 5.5.1 contains a patch for this vulnerability.
- Product
- AdminLTE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2021Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics.CVE-2021-32706 · Other software · pi-hole · reported by GitHubHigh 7.6
Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5.1, the `validDomainWildcard` preg_match filter allows a malicious character through that can be used to execute code, list directories, and overwrite sensitive files. The issue lies in the fact that one of the periods is not escaped, allowing any character to be used in its place. A patch for this vulnerability was released in version 5.5.1.
- Product
- AdminLTE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2021Pi-hole is a Linux network-level advertisement and Internet tracker blocking application.CVE-2021-29448 · Other software · pi-hole · reported by GitHubHigh 7.6
Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. The Stored XSS exists in the Pi-hole Admin portal, which can be exploited by the malicious actor with the network access to DNS server. See the referenced GitHub security advisory for patch details.
- Product
- AdminLTE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2021Pi-hole is a Linux network-level advertisement and Internet tracker blocking application.CVE-2021-29449 · Other software · pi-hole · reported by GitHubMedium 6.3
Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Multiple privilege escalation vulnerabilities were discovered in version 5.2.4 of Pi-hole core. See the referenced GitHub security advisory for details.
- Product
- pi-hole
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2021Pi-hole 5.0, 5.1, and 5.1.1 allows XSS via the Options header to the admin/ URI.CVE-2020-35592 · Other software · Pi-hole · reported by MITREMedium 5.4
Pi-hole 5.0, 5.1, and 5.1.1 allows XSS via the Options header to the admin/ URI. A remote user is able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Reflected Cross-Site Scripting attack against other users and steal the session cookie.
- Product
- Pi-hole
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscourse.pi-hole.netn4nj0.github.io
Feb 18, 2021Pi-hole 5.0, 5.1, and 5.1.1 allows Session Fixation.CVE-2020-35591 · Other software · Pi-hole · reported by MITREMedium 5.4
Pi-hole 5.0, 5.1, and 5.1.1 allows Session Fixation. The application does not generate a new session cookie after the user is logged in. A malicious user is able to create a new session cookie value and inject it to a victim. After the victim logs in, the injected cookie becomes valid, giving the attacker access to the user's account through the active session.
- Product
- Pi-hole
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscourse.pi-hole.netn4nj0.github.io
Dec 24, 2020The DNS query log in Pi-hole before 5.2.2 is vulnerable to stored XSS.CVE-2020-35659 · Other software · Pi-hole · reported by MITREMedium 6.1
The DNS query log in Pi-hole before 5.2.2 is vulnerable to stored XSS. An attacker with the ability to directly or indirectly query DNS with a malicious hostname can cause arbitrary JavaScript to execute when the Pi-hole administrator visits the Query Log or Long-term data Query Log page.
- Product
- Pi-hole
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.mirch.iodiscourse.pi-hole.net
Jul 30, 2020An issue was discovered in Pi-Hole through 5.0.CVE-2020-14162 · Other software · Pi-hole · reported by MITREHigh 7.8
An issue was discovered in Pi-Hole through 5.0. The local www-data user has sudo privileges to execute the pihole core script as root without a password, which could allow an attacker to obtain root access via shell metacharacters to this script's setdns command.
- Product
- Pi-hole
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record0xpanic.github.iodocs.pi-hole.net
Jul 30, 2020Pi-hole 4.4 allows a user able to write to /etc/pihole/dns-servers.conf to escalate privileges through command injection (shell metacharacters after an IP addreCVE-2020-12620 · Other software · Pi-hole · reported by MITREHigh 7.8
Pi-hole 4.4 allows a user able to write to /etc/pihole/dns-servers.conf to escalate privileges through command injection (shell metacharacters after an IP address).
- Product
- Pi-hole
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record0xpanic.github.iogithub.com
Jun 23, 2020Pi-hole through 5.0 allows code injection in piholedhcp (the Static DHCP Leases section) by modifying Teleporter backup files and then restoring them.CVE-2020-14971 · Other software · Pi-hole · reported by MITREHigh 7.8
Pi-hole through 5.0 allows code injection in piholedhcp (the Static DHCP Leases section) by modifying Teleporter backup files and then restoring them. This occurs in settings.php. To exploit this, an attacker would request a backup of limited files via teleporter.php. These are placed into a .tar.gz archive. The attacker then modifies the host parameter in dnsmasq.d files, and then compresses and uploads these files again.
- Product
- Pi-hole
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.telspace.co.zagithub.com
May 29, 2020Pi-Hole AdminLTE Remote Code Execution VulnerabilityCVE-2020-8816 · Other software · Pi-hole · reported by MITREExploitedHigh 7.2
Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.
- Product
- AdminLTE
- On CISA’s list since
- Dec 10, 2021 (federal fix deadline Jun 10, 2022)
- What to do
- Attackers are using this now. Install Pi-hole’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.compacketstormsecurity.com
May 11, 2020The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files.CVE-2020-11108 · Other software · Pi-hole · reported by MITREHigh 8.8
The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files. This can be abused for Remote Code Execution by writing to a PHP file in the web directory. (Also, it can be used in conjunction with the sudo rule for the www-data user to escalate privileges to root.) The code error is in gravity_DownloadBlocklistFromUrl in gravity.sh.
- Product
- Pi-hole
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 9, 2019Pi-Hole 4.3 allows Command Injection.CVE-2019-13051 · Other software · Pi-hole · reported by MITREHigh 8.8
Pi-Hole 4.3 allows Command Injection.
- Product
- Pi-hole
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.