PT-2025-44019

Name of the Vulnerable Software and Affected Versions Pi-hole Admin Interface versions 6.2.1 and earlier Description The Pi-hole Admin Interface, a web interface for managing the Pi-hole network-level advertisement and internet tracker blocking application, is susceptible to reflected cross-site...

EUVD-2021-16065

Malware in sbrugna...

EUVD-2020-4921

Malware in sbrugna...

EUVD-2020-7101

Malware in sbrugna...

EUVD-2020-23322

Malware in sbrugna...

EUVD-2020-6319

Malware in sbrugna...

EUVD-2020-23257

Malware in sbrugna...

EUVD-2021-19556

Malware in sbrugna...

EUVD-2020-23258

Malware in sbrugna...

EUVD-2023-27710

Malicious code in bioql PyPI...

EUVD-2025-19902

Malicious code in bioql PyPI...

EUVD-2022-52722

Malicious code in bioql PyPI...

EUVD-2021-28278

Malicious code in bioql PyPI...

EUVD-2022-28554

Malicious code in bioql PyPI...

Pi-Hole Web Detection

Binary data piholewebdetect.nbin...

Pi-Hole Web 4.3.2 < 4.3.3 RCE

The version of Pi-Hole Web running on the remote web server is 4.3.2 prior to 4.3.3. It is, therefore, affected by a remote code execution vulnerability by privileged dashboard users via a crafted DHCP static lease. Note that Nessus has not tested for this issue but has instead relied only on the...

CVE-2025-34087

An authenticated command injection vulnerability exists in Pi-hole versions up to 3.3. When adding a domain to the allowlist via the web interface, the domain parameter is not properly sanitized, allowing an attacker to append OS commands to the domain string. These commands are executed on the...

CVE-2025-34087

An authenticated command injection vulnerability exists in Pi-hole versions up to 3.3. When adding a domain to the allowlist via the web interface, the domain parameter is not properly sanitized, allowing an attacker to append OS commands to the domain string. These commands are executed on the...

CVE-2025-34087

CVE-2025-34087: An authenticated command-injection in Pi-hole’s web interface (legacy AdminLTE) exists up to version 3.3, where unsanitized domain input added to the allowlist can be exploited to execute OS commands as the Pi-hole service user. The issue is tied to the legacy AdminLTE interface a...

CVE-2025-34087 Pi-Hole AdminLTE Whitelist (now 'Web Allowlist') Remote Command Execution

An authenticated command injection vulnerability exists in Pi-hole versions up to 3.3. When adding a domain to the allowlist via the web interface, the domain parameter is not properly sanitized, allowing an attacker to append OS commands to the domain string. These commands are executed on the...