PI-Hole / Web Interface

16 CVEs

CVE ID	Description	Severity	CVSS	Published
CVE-2026-33405	Pi-hole has a Stored HTML Injection in queries.js	MEDIUM	4.8	Apr 6, 2026
CVE-2026-33406	Pi-hole has a Stored HTML attribute injection	MEDIUM	6.1	Apr 6, 2026
CVE-2026-33404	Pi-hole has a Stored XSS / HTML injection in the Network page/Dashboard	MEDIUM	6.1	Apr 6, 2026
CVE-2026-33403	Pi-hole has a Reflected XSS / HTML injection in taillog.js	MEDIUM	6.1	Apr 6, 2026
CVE-2026-33765	Pi-hole Web Interface has a Command Injection Vulnerability	HIGH	8.9	Mar 27, 2026
CVE-2026-26953	Pi-hole Web Interface has Stored HTML Injection via X-Forwarded-For Header in Active Sessions Table	MEDIUM	5.4	Feb 19, 2026
CVE-2026-26952	Pi-hole Web Interface has Stored HTML Injection via Local DNS Records (CNAME/Hosts) in data-tag Attribute	MEDIUM	5.4	Feb 19, 2026
CVE-2025-59151	Pi-hole Admin Interface vulnerable to HTTP response header injection via CRLF injection	HIGH	8.2	Oct 27, 2025
CVE-2025-53533	Pi-hole Admin Interface vulnerable to cross-site scripting via malformed URL path on 404 error page	MEDIUM	5.1	Oct 27, 2025
CVE-2025-32785	Pi-hole Admin Interface vulnerable to persistent XSS on Subscribed lists group management (Adress Field)	LOW	2.0	Oct 27, 2025
CVE-2023-23614	Improper session handling of "Remember me for 7 days" functionality	HIGH	8.8	Jan 26, 2023
CVE-2021-41175	Stored XSS in Client Groups Management (Authenticated)	HIGH	7.3	Oct 26, 2021
CVE-2021-3812	Cross-site Scripting (XSS) - Reflected in pi-hole/adminlte	MEDIUM	6.1	Sep 17, 2021
CVE-2021-3811	Cross-site Scripting (XSS) - Reflected in pi-hole/adminlte	MEDIUM	6.1	Sep 17, 2021
CVE-2021-3706	Sensitive Cookie Without 'HttpOnly' Flag in pi-hole/adminlte	HIGH	7.5	Sep 15, 2021
CVE-2021-29448	Stored DOM XSS in Pi-hole Admin Web Interface	HIGH	8.8	Apr 15, 2021

Rows per page

Showing 1 to 16 of 16 CVEs