CVE-2021-29448

Pi-hole exposes a Stored XSS vulnerability in the Admin portal (Web Interface) of Pi-hole, described across multiple sources. The issue is a stored DOM/XSS flaw in the AdminLTE-based interface that can be triggered by an attacker with network access to the DNS server. Affected is Pi-hole’s admin/...

CVE-2023-23614

Pi-hole Web Interface (AdminLTE) versions 4.0–5.18.2 are affected by Insufficient Session Expiration due to improper use of the admin WEBPASSWORD hash as the Remember me for 7 days cookie. The cookie’s value can be used to login (pass-the-hash) and remains valid so long as the admin password is u...

CVE-2021-41175

Pi-hole Web Interface (AdminLTE) is affected by a Stored XSS vulnerability in the groups-clients management page. The issue exists prior to version 5.8 and can be triggered when adding a client, enabling an attacker with access to the web UI to inject and execute script in an authenticated contex...

CVE-2021-3706

The CVE-2021-3706 entry affects Pi-hole’s AdminLTE-based web interface. Affected component: the adminlte/persistentlogin cookie is set without the HttpOnly flag, making the cookie accessible to JavaScript and susceptible to theft via XSS. The OpenVAS PoC documents show a login flow where the pers...

CVE-2021-3811

CVE-2021-3811 affects Pi-hole’s AdminLTE (the Pi-hole web interface). The vulnerability is an XSS in the adminlte component caused by improper neutralization of input during web page generation. The documented impact is a reflected Cross-site Scripting vulnerability exposed via a POST parameter (...

CVE-2021-3812

CVE-2021-3812 affects the Pi-hole Web Interface (AdminLTE) component. The vulnerability is a Cross-site Scripting (XSS) issue caused by improper neutralization of input during web page generation, with multiple sources indicating a reflected XSS in pi-hole/adminlte. Impact is described as potenti...

CVE-2025-53533

CVE-2025-53533 affects Pi-hole Admin Interface ≤ 6.2.1. It is a reflected XSS in the 404 page caused by including the requested path in the body tag’s class attribute without proper sanitization, enabling an attacker to craft a link with an onload attribute that executes arbitrary JavaScript in a...

CVE-2026-33405

Pi-hole Admin Interface (Pi-hole) versions 6.0–6.5 are affected by a stored HTML injection in the formatInfo() function of queries.js, which renders data.upstream, data.client.ip, and data.ede.text without escaping when expanding a Query Log row. The vulnerability could allow HTML injection despi...

CVE-2026-26952

Technical details beyond the initial description are not provided in the connected documents. Publicly available data describes stored HTML injection in Pi-hole Admin Interface up to version 6.4; no additional technical specifics are included here. Monitor for updates.

CVE-2026-33406

Pi-hole Admin Interface (6.0–before 6.5) contains a stored HTML attribute injection in the /api/config values embedded into HTML value="" attributes via settings-advanced.js, enabling attribute-level manipulation. The root cause is unescaped config values, which can break out of the attribute con...

CVE-2026-26953

Pi-hole Admin Interface (web UI for Pi-hole) versions 6.0+ expose a Stored HTML Injection in the active sessions table of the API settings page. The vulnerability arises because the rowCallback reads data.x_forwarded_for and directly concatenates it into HTML inserted via jQuery .html(), allowing...

CVE-2026-33765

Summary: Pi-hole Admin Interface (web) prior to 6.0 contains a critical OS command injection in savesettings.php. The vulnerability arises from unsanitized user-controlled $_POST['webtheme'] being concatenated into a system command executed via PHP’s exec(), with the command running under sudo pr...

CVE-2025-32785

Pi-hole Admin Interface (Pi-hole) versions prior to 6.3 are vulnerable to cross-site scripting (XSS) via the Address field in the Subscribed Lists group management. An authenticated user can inject JavaScript by placing a payload in Address when creating or editing a list entry. The XSS is trigge...

CVE-2025-59151

Pi-hole Admin Interface prior to 6.3 is vulnerable to CRLF injection via redirects on requests for files ending with .lp, allowing an attacker to inject arbitrary HTTP response headers and potentially affect session fixation, cache poisoning, and weakening of CSP or X-XSS-Protection. Root cause: ...

CVE-2026-33403

CVE-2026-33403 concerns Pi-hole Admin Interface. A reflected DOM-based XSS in taillog.js from 6.0 up to before 6.5 allows an unauthenticated attacker to inject arbitrary HTML via a crafted URL, since the query parameter is interpolated into innerHTML without escaping. The vulnerability is aggrava...

CVE-2026-33404

Pi-hole Admin Interface (Pi-hole) up to version 6.5 is affected by a stored XSS in the Network page and Dashboard tooltips due to unescaped DOM rendering of client hostnames and IPs from the FTL database in network.js and charts.js/index.js. The issue occurs for 6.0 through before 6.5, when user-...