Priority CRITICAL 91KEV
Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.78336 · Published 2020-05-29 · No fix listed CWE-78
Priority HIGH 78
The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.78262 · Published 2020-05-11 · No fix listed CWE-434
Priority HIGH 73
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software.
CVSS 3.1HIGH 8.8· Local · Low privileges · No interaction · EPSS 0.00257 · Published 2026-07-14 · Fixed in 6.4.3 CWE-282
Priority HIGH 73
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.02828 · Published 2024-07-05 · Fixed in 5.18.3 CWE-918
Priority HIGH 72
Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.60181 · Published 2021-08-04 · Fixed in 5.5.1 CWE-94
Priority HIGH 68
The Pi-hole is a DNS sinkhole that protects your devices from unwanted content without installing any client-side software.
CVSS 3.1HIGH 7.6· Network · Low privileges · No interaction · EPSS 0.01414 · Published 2024-03-27 · No fix listed CWE-200
Priority MEDIUM 57
An authenticated command injection vulnerability exists in Pi-hole versions up to 3.3.
CVSS 4.0CRITICAL 9.0· Network · Low privileges · No interaction · EPSS 0.07039 · Published 2025-07-03 · No fix listed CWE-78
Priority MEDIUM 52
Pi-Hole 4.3 allows Command Injection.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.12467 · Published 2019-10-09 · No fix listed CWE-78
Priority LOW 39
Pi-hole is a Linux network-level advertisement and Internet tracker blocking application.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00692 · Published 2021-04-15 · No fix listed CWE-79
Priority LOW 38
Pi-hole is a Linux network-level advertisement and Internet tracker blocking application.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.01848 · Published 2021-04-14 · No fix listed CWE-269
Priority LOW 37
Pi-hole 4.4 allows a user able to write to /etc/pihole/dns-servers.conf to escalate privileges through command injection (shell metacharacters after an IP address).
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.01502 · Published 2020-07-30 · No fix listed CWE-78
Priority LOW 35
Pi-hole through 5.0 allows code injection in piholedhcp (the Static DHCP Leases section) by modifying Teleporter backup files and then restoring them.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00553 · Published 2020-06-23 · No fix listed CWE-862
Priority LOW 35
An issue was discovered in Pi-Hole through 5.0.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00587 · Published 2020-07-30 · No fix listed CWE-269
Priority LOW 33
Pi-hole before 6 allows unauthenticated admin/api.php?setTempUnit= calls to change the temperature units of the web dashboard.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00471 · Published 2024-08-19 · No fix listed CWE-862
Priority LOW 31
Pi-hole is a Linux network-level advertisement and Internet tracker blocking application.
CVSS 3.1MEDIUM 6.7· Local · High privileges · No interaction · EPSS 0.00224 · Published 2026-04-06 · Fixed in 6.4.1 CWE-269
Priority LOW 29
The DNS query log in Pi-hole before 5.2.2 is vulnerable to stored XSS.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00952 · Published 2020-12-24 · No fix listed CWE-79
Priority LOW 27
Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics.
CVSS 3.1MEDIUM 5.7· Network · High privileges · User interaction · EPSS 0.00791 · Published 2021-08-04 · Fixed in 5.5.1 CWE-79
Priority LOW 27
Pi-hole 5.0, 5.1, and 5.1.1 allows Session Fixation.
CVSS 3.1MEDIUM 5.4· Network · No auth · User interaction · EPSS 0.0114 · Published 2021-02-18 · No fix listed CWE-384
Priority LOW 26
Pi-hole 5.0, 5.1, and 5.1.1 allows XSS via the Options header to the admin/ URI.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00857 · Published 2021-02-18 · No fix listed CWE-79
THREATIST.IORead the docs