Advisories · Technology
pi-hole web.
Every CVE that names pi-hole web among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 3.1 Low
Pi-hole has a Stored HTML Injection in queries.js
- pi-hole web
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Pi-hole has a Stored HTML attribute injection
- pi-hole web
- Cross-site scripting (XSS)
- CVSS 3.4 Low
Pi-hole has a Stored XSS / HTML injection in the Network page/Dashboard
- pi-hole web
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Pi-hole has a Reflected XSS / HTML injection in taillog.js
- pi-hole web
- Cross-site scripting (XSS)
- CVSS 8.9 High
Pi-hole Web Interface has a Command Injection Vulnerability
- pi-hole web
- Command injection
- CVSS 5.4 Medium
Pi-hole Web Interface has Stored HTML Injection via X-Forwarded-For Header in Active Sessions Table
- pi-hole web
- Cross-site scripting (XSS)
- CWE-20
- CVSS 5.4 Medium
Pi-hole Web Interface has Stored HTML Injection via Local DNS Records (CNAME/Hosts) in data-tag Attribute
- pi-hole web
- Cross-site scripting (XSS)
- CWE-20
- CVSS 8.2 High
Pi-hole Admin Interface vulnerable to HTTP response header injection via CRLF injection
- pi-hole web
- Other injection
- CVSS 5.1 Medium
Pi-hole Admin Interface vulnerable to cross-site scripting via malformed URL path on 404 error page
- pi-hole web
- Cross-site scripting (XSS)
- CVSS 2.0 Low
Pi-hole Admin Interface vulnerable to persistent XSS on Subscribed lists group management (Adress Field)
- pi-hole web
- Cross-site scripting (XSS)