Vendor
pi-hole
38 known vulnerabilities.
Products
4 results · Clear filters · Feed
-
Low 2.2
Pi-hole: file:// adlist read check and curl can resolve different files
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, gravity.sh checks file:// adlist readability with sudo -u pihole test -r but then allows curl, sometimes running as root, to norma…
-
Low 3.1
Pi-hole has a Stored HTML Injection in queries.js
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, the formatInfo() function in queries.js renders data.upstream, data.client.ip, and data.ede.text into HTML w…
-
Low 3.4
Pi-hole has a Stored XSS / HTML injection in the Network page/Dashboard
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, client hostnames and IP addresses from the FTL database are rendered into the DOM without escaping in networ…
-
Low 2.0
Pi-hole Admin Interface vulnerable to persistent XSS on Subscribed lists group management (Adress Field)
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interface versions prior to 6.3 are vulnerable to cross-site scripting (XSS) via the Address field in the S…