CVE-2026-26953: Improper Input Validation

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. Versions 6.0 and above have a Stored HTML Injection vulnerability in the active sessions table located on the API settings page, allowing an attacker with valid credentia...

PT-2026-20961

Name of the Vulnerable Software and Affected Versions Pi-hole versions 6.0 through 6.4.0 Description Pi-hole Admin Interface, a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application, contains a Stored HTML Injection issue in the active sessions table on...

Pi-hole 安全漏洞

Pi-hole is a web-level ad blocking application developed by Pi-hole Inc. Versions of Pi-hole 6.4 and earlier contained a security vulnerability, which was caused by a storage-type HTML injection vulnerability in the local DNS record configuration page. This vulnerability could allow arbitrary HTM...

Pi-hole Web Interface 安全漏洞

The Pi-hole Web Interface is an open-source dashboard web interface developed by Pi-hole. Versions of the Pi-hole Web Interface 6.0 and later contain security vulnerabilities. These vulnerabilities stem from a storage-type HTML injection vulnerability in the API settings page’s activity session...

CVE-2026-26952: Improper Input Validation

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. Versions 6.4 and below are vulnerable to stored HTML injection through the local DNS records configuration page, which allows an authenticated administrator to inject cod...

PT-2026-20953

Name of the Vulnerable Software and Affected Versions Pi-hole versions 6.4 and below Description Pi-hole Admin Interface, a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application, is susceptible to stored HTML injection through the local DNS records...

The vulnerability of the Pi-hole advertising blocking app arises from the failure to take measures to neutralize special elements used in the operating system’s command set. This allows a violator to execute arbitrary code.

The vulnerability of the Pi-hole ad-blocking application is related to the failure to take measures to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of applications for blocking advertisements and Pi-hole internet trackers relates to the lack of measures taken to protect the structure of web pages. This allows a violator to execute arbitrary code.

The vulnerability of the application for blocking advertisements and Pi-hole internet trackers is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

CVE-2022-31029

AdminLTE is a Pi-hole Dashboard for stats and configuration. In affected versions inserting code like in the field marked with "Domain to look for" and hitting enter or clicking on any of the buttons will execute the script. The user must be logged in to use this vulnerability. Usually only...

CVE-2024-34361

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. A vulnerability in versions prior to 5.18.3 allows an authenticated user to make internal requests to the server via the gravityDownloadBlocklistFromUrl function. Depending on some...

Pi-hole: undisclosed vulnerability (ZAI-2026-H7OUWI)

Not disclosed. Details are not yet publicly disclosed...

Pi-hole: undisclosed vulnerability (ZAI-2026-XK0HNG)

Not disclosed. Details are not yet publicly disclosed...

Pi-hole: undisclosed vulnerability (ZAI-2026-OD1W0I)

Not disclosed. Details are not yet publicly disclosed...

Pi-hole: undisclosed vulnerability (ZAI-2026-JO2OVE)

Not disclosed. Details are not yet publicly disclosed...

Pi-hole: undisclosed vulnerability (ZAI-2026-9Y6VGD)

Not disclosed. Details are not yet publicly disclosed...

Pi-hole: undisclosed vulnerability (ZAI-2026-0P0LJ6)

Not disclosed. Details are not yet publicly disclosed...

Pi-hole: undisclosed vulnerability (ZAI-2026-OLWNGT)

Not disclosed. Details are not yet publicly disclosed...

Pi-hole: undisclosed vulnerability (ZAI-2026-DWBG7D)

Not disclosed. Details are not yet publicly disclosed...

Pi-hole: undisclosed vulnerability (ZAI-2026-65C1OP)

Not disclosed. Details are not yet publicly disclosed...

📄 Pi-hole 5.18.3 Remote Code Execution

This PHP script is an authenticated remote code execution exploit targeting Pi-hole's web admin interface. It requires valid administrator credentials to log in, obtains a CSRF token, and abuses the adlist management feature by injecting a crafted gopher:// URL. The payload forces the server to...