pi-hole

8 results · Clear filters · Feed

• High 8.8
  CVE-2026-35517 Public exploit

  Pi-hole FTL affected by Remote Code Execution (RCE) via dns.upstreams Newline Injection

  FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the upstream DNS servers configuration parameter …

  pi-hole FTL
  Apr 7, 2026
• Medium 5.1
  CVE-2025-53533 Public exploit Scanner template

  Pi-hole Admin Interface vulnerable to cross-site scripting via malformed URL path on 404 error page

  Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interface versions 6.2.1 and earlier are vulnerable to reflected cross-site scripting (XSS) via a malformed…

  pi-hole web
  Oct 27, 2025
• Critical 9.0
  CVE-2025-34087 Public exploit

  Pi-Hole AdminLTE Whitelist (now 'Web Allowlist') Remote Command Execution

  An authenticated command injection vulnerability exists in Pi-hole versions up to 3.3. When adding a domain to the allowlist via the web interface, the domain parameter is not properly sanitized, allowing an attacker to append OS commands to the domain string…

  pi-hole web
  Jul 3, 2025
• High 8.6
  CVE-2024-34361 Public exploit

  Pi-hole Blind Server-Side Request Forgery (SSRF) vulnerability can lead to Remote Code Execution (RCE)

  Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. A vulnerability in versions prior to 5.18.3 allows an authenticated user to make internal requests to the server via the `gravity_DownloadBlockl…

  pi-hole pi-hole
  Jul 5, 2024
• High 7.6
  CVE-2024-28247 Public exploit

  Pihole Authenticated Arbitrary File Read with root privileges

  The Pi-hole is a DNS sinkhole that protects your devices from unwanted content without installing any client-side software. A vulnerability has been discovered in Pihole that allows an authenticated user on the platform to read internal server files arbitrari…

  pi-hole pi-hole
  Mar 27, 2024
• Medium 5.3
  CVE-2022-23513 Public exploit EPSS 42%

  Pi-Hole/AdminLTE vulnerable due to improper access control in queryads endpoint

  Pi-Hole is a network-wide ad blocking via your own Linux hardware, AdminLTE is a Pi-hole Dashboard for stats and more. In case of an attack, the threat actor will obtain the ability to perform an unauthorized query for blocked domains on `queryads` endpoint. …

  pi-hole AdminLTE
  Dec 22, 2022
• High 7.6
  CVE-2021-32706 Public exploit EPSS 60%

  (Authenticated) Remote Code Execution Possible in Web Interface 5.5

  Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5.1, the `validDomainWildcard` preg_match filter allows a malicious character through that can be used…

  pi-hole AdminLTE
  Aug 4, 2021
• Medium 6.3
  CVE-2021-29449 Public exploit

  Multiple Privilege Escalation Vulnerabilities Pihole

  Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Multiple privilege escalation vulnerabilities were discovered in version 5.2.4 of Pi-hole core. See the referenced GitHub security advisory for details.

  pi-hole pi-hole
  Apr 14, 2021