What’s Vulnerable › Products

pi-hole web vulnerabilities

16 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 10 published in the last 12 months.

Check whether your pi-hole web version is affected

Latest pi-hole web vulnerabilities

• CVE-2026-33405 — Pi-hole has a Stored HTML Injection in queries.js (CVSS 4.8)
• CVE-2026-33406 — Pi-hole has a Stored HTML attribute injection (CVSS 6.1)
• CVE-2026-33404 — Pi-hole has a Stored XSS / HTML injection in the Network page/Dashboard (CVSS 6.1)
• CVE-2026-33403 — Pi-hole has a Reflected XSS / HTML injection in taillog.js (CVSS 6.1)
• CVE-2026-33765 — Pi-hole Web Interface has a Command Injection Vulnerability (CVSS 9.8)
• CVE-2026-26953 — Pi-hole Web Interface has Stored HTML Injection via X-Forwarded-For Header in Active Sessions Table (CVSS 5.4)
• CVE-2026-26952 — Pi-hole Web Interface has Stored HTML Injection via Local DNS Records (CNAME/Hosts) in data-tag Attribute (CVSS 5.4)
• CVE-2025-59151 — Pi-hole Admin Interface vulnerable to HTTP response header injection via CRLF injection (CVSS 8.2)
• CVE-2025-53533 — Pi-hole Admin Interface vulnerable to cross-site scripting via malformed URL path on 404 error page (CVSS 6.1)
• CVE-2025-32785 — Pi-hole Admin Interface vulnerable to persistent XSS on Subscribed lists group management (Adress Field) (CVSS 5.4)
• CVE-2023-23614 — Improper session handling of "Remember me for 7 days" functionality (CVSS 8.8)
• CVE-2021-41175 — Stored XSS in Client Groups Management (Authenticated) (CVSS 5.4)
• CVE-2021-3812 — Cross-site Scripting (XSS) - Reflected in pi-hole/adminlte (CVSS 6.1)
• CVE-2021-3811 — Cross-site Scripting (XSS) - Reflected in pi-hole/adminlte (CVSS 6.1)
• CVE-2021-3706 — Sensitive Cookie Without 'HttpOnly' Flag in pi-hole/adminlte (CVSS 7.5)
• CVE-2021-29448 — Stored DOM XSS in Pi-hole Admin Web Interface (CVSS 8.8)