Skip to content
Noroxi

pi-hole records

43 published records for vendor pi-hole.

Researcher profile

Entered KEV
1 · 2.3%
Weaponized
5 · 11.6%
Pre-auth RCE
3
With a fix record
46.5%
Median publish → KEV
560 days

Records by year

  1. 19
  2. 20
  3. 21
  4. 22
  5. 23
  6. 24
  7. 25
  8. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

43 records
  • CVE-2020-8816
    82Now

    Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.

    HighCVSS 7.2KEVWeaponizedEPSS 78%

    pi-hole · pi-holeMay 29, 2020

  • CVE-2020-11108
    58Plan

    The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files.

    HighCVSS 8.8WeaponizedEPSS 78%

    pi-hole · pi-holeMay 11, 2020

  • CVE-2021-32706
    53Plan

    (Authenticated) Remote Code Execution Possible in Web Interface 5.5

    HighCVSS 8.8WeaponizedEPSS 60%

    pi-hole · pi-holeAug 4, 2021

  • CVE-2025-34087
    40Plan

    Pi-Hole AdminLTE Whitelist (now 'Web Allowlist') Remote Command Execution

    CriticalCVSS 9.0WeaponizedEPSS 7%

    pi-hole · pi-holeJul 3, 2025

  • CVE-2021-29449
    40Plan

    Multiple Privilege Escalation Vulnerabilities Pihole

    HighCVSS 7.8WeaponizedEPSS 1%

    pi-hole · pi-holeApr 14, 2021

  • CVE-2019-13051
    39Monitor

    Pi-Hole 4.3 allows Command Injection.

    HighCVSS 8.8Proof of conceptEPSS 12%

    pi-hole · pi-holeOct 9, 2019

  • CVE-2024-34361
    36Monitor

    Pi-hole Blind Server-Side Request Forgery (SSRF) vulnerability can lead to Remote Code Execution (RCE)

    HighCVSS 8.8Proof of conceptEPSS 2%

    pi-hole · pi-holeJul 5, 2024

  • CVE-2026-33765
    35Monitor

    Pi-hole Web Interface has a Command Injection Vulnerability

    HighCVSS 8.9No exploitEPSS 1%

    pi-hole · web interfaceMar 27, 2026

  • CVE-2023-23614
    35Monitor

    Improper session handling of "Remember me for 7 days" functionality

    HighCVSS 8.8No exploitEPSS 0%

    pi-hole · web interfaceJan 26, 2023

  • CVE-2026-35517
    35Monitor

    Pi-hole FTL affected by Remote Code Execution (RCE) via dns.upstreams Newline Injection

    HighCVSS 8.8Proof of conceptEPSS 0%

    pi-hole · ftldnsApr 7, 2026

  • CVE-2026-35518
    35Monitor

    Pi-hole FTL affected by Remote Code Execution (RCE) via dns.cnameRecords Newline Injection

    HighCVSS 8.8No exploitEPSS 0%

    pi-hole · ftldnsApr 7, 2026

  • CVE-2026-35520
    35Monitor

    Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.leaseTime Newline Injection

    HighCVSS 8.8No exploitEPSS 0%

    pi-hole · ftldnsApr 7, 2026

  • CVE-2026-35521
    35Monitor

    Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.hosts Newline Injection

    HighCVSS 8.8No exploitEPSS 0%

    pi-hole · ftldnsApr 7, 2026

  • CVE-2021-29448
    35Monitor

    Stored DOM XSS in Pi-hole Admin Web Interface

    HighCVSS 8.8No exploitEPSS 0%

    pi-hole · ftldnsApr 15, 2021

  • CVE-2026-35519
    35Monitor

    Pi-hole FTL affected by Remote Code Execution (RCE) via dns.hostRecord Newline Injection

    HighCVSS 8.8No exploitEPSS 0%

    pi-hole · ftldnsApr 7, 2026

  • CVE-2026-50130
    35Monitor

    Pi-hole: Local privilege escalation from `pihole` user to root via `/etc/pihole/logrotate`

    HighCVSS 8.8No exploitEPSS 0%

    pi-hole · pi-holeJul 14, 2026

  • CVE-2022-23513
    34Monitor

    Pi-Hole/AdminLTE vulnerable due to improper access control in queryads endpoint

    MediumCVSS 5.3Proof of conceptEPSS 42%

    pi-hole · adminlteDec 22, 2022

  • CVE-2026-39849
    34Monitor

    Pi-hole FTL remote code execution via newline injection in dns.interface configuration

    HighCVSS 8.7No exploitEPSS 0%

    pi-hole · ftldnsMay 5, 2026

  • CVE-2025-59151
    32Monitor

    Pi-hole Admin Interface vulnerable to HTTP response header injection via CRLF injection

    HighCVSS 8.2No exploitEPSS 0%

    pi-hole · web interfaceOct 27, 2025

  • CVE-2020-12620
    31Monitor

    Pi-hole 4.4 allows a user able to write to /etc/pihole/dns-servers.conf to escalate privileges through command injection (shell metacharacte

    HighCVSS 7.8No exploitEPSS 1%

    pi-hole · pi-holeJul 30, 2020

  • CVE-2020-14162
    31Monitor

    An issue was discovered in Pi-Hole through 5.0.

    HighCVSS 7.8No exploitEPSS 0%

    pi-hole · pi-holeJul 30, 2020

  • CVE-2020-14971
    31Monitor

    Pi-hole through 5.0 allows code injection in piholedhcp (the Static DHCP Leases section) by modifying Teleporter backup files and then resto

    HighCVSS 7.8No exploitEPSS 0%

    pi-hole · pi-holeJun 23, 2020

  • CVE-2021-3706
    30Monitor

    Sensitive Cookie Without 'HttpOnly' Flag in pi-hole/adminlte

    HighCVSS 7.5No exploitEPSS 1%

    pi-hole · web interfaceSep 15, 2021

  • CVE-2024-44069
    30Monitor

    Pi-hole before 6 allows unauthenticated admin/api.php?setTempUnit= calls to change the temperature units of the web dashboard.

    HighCVSS 7.5No exploitEPSS 0%

    pi-hole · pi-holeAug 18, 2024

  • CVE-2024-28247
    26Monitor

    Pihole Authenticated Arbitrary File Read with root privileges

    MediumCVSS 6.5Proof of conceptEPSS 1%

    pi-hole · pi-holeMar 27, 2024