Threat Intelligence Database

CVE-2026-30761 is an arbitrary file upload vulnerability in the pages/admin.uploadmapimg.php component of SourceBans Material Admin v1.1.6. This flaw allows attackers to upload crafted image files that can lead to arbitrary code execution. The vulnerability has a CVSS 3.1 base score of 7.3, indicating a high severity level. No patch or official remediation guidance is currently available, and there are no known exploits in the wild at this time.

CVE-2026-30760 is a high-severity vulnerability in SourceBans Material Admin versions before 1.1.6. It allows attackers to manipulate arbitrary user data in the web application by sending crafted XAJAX calls. The vulnerability has a CVSS score of 7.3, indicating significant impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently confirmed. There are no known exploits in the wild at this time.

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, the formatInfo() function in queries.js renders data.upstream, data.client.ip, and data.ede.text into HTML without escaping when a user expands a query row in the Query Log, enabling stored HTML injection. JavaScript execution is blocked by the server's CSP (script-src 'self'). The same fields are properly escaped in the table view (rowCallback), confirming the omission was an oversight. This vulnerability is fixed in 6.5.

CVE-2026-33406 is a medium severity cross-site scripting (XSS) vulnerability in the Pi-hole Admin Interface web application versions 6.0 up to but not including 6.5. It arises from improper neutralization of input when configuration values from the /api/config endpoint are inserted directly into HTML attribute values without escaping, allowing injection of HTML attributes. Although JavaScript execution is blocked by the server's Content Security Policy (CSP), the injected attributes can manipulate element styling, enabling UI redressing attacks. The main attack vector is importing a malicious teleporter backup, which circumvents per-field server-side validation. This vulnerability has been fixed in Pi-hole version 6.5.

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, client hostnames and IP addresses from the FTL database are rendered into the DOM without escaping in network.js (Network page) and charts.js/index.js (Dashboard chart tooltips). While upstream validation in dnsmasq and FTL blocks HTML characters via normal DHCP/DNS paths, the web UI performs no output escaping — an inconsistency with other fields in the same file that are properly escaped. This vulnerability is fixed in 6.5.

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, a reflected DOM-based XSS vulnerability in taillog.js allows an unauthenticated attacker to inject arbitrary HTML into the Pi-hole admin interface by crafting a malicious URL. The file query parameter is interpolated into an innerHTML assignment without escaping. Because the Content-Security-Policy is missing the form-action directive, injected <form> elements can exfiltrate credentials to an external origin. This vulnerability is fixed in 6.5.

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. Versions prior to 6.0 have a critical OS Command Injection vulnerability in the savesettings.php file. The application takes the user-controlled $_POST['webtheme'] parameter and concatenates it directly into a system command executed via PHP's exec() function. Since the input is neither sanitized nor validated before being passed to the shell, an attacker can append arbitrary system commands to the intended pihole command. Furthermore, because the command is executed with sudo privileges, the injected commands will run with elevated (likely root) privileges. Version 6.0 patches the issue.

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

MediumVulnerabilityGermanyFranceUnited Kingdom+3#cve#cve-2025-55063#cwe-79

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interface before 6.3 is vulnerable to Carriage Return Line Feed (CRLF) injection. When a request is made to a file ending with the .lp extension, the application performs a redirect without properly sanitizing the input. An attacker can inject carriage return and line feed characters (%0d%0a) to manipulate both the headers and the content of the HTTP response. This enables the injection of arbitrary HTTP response headers, potentially leading to session fixation, cache poisoning, and the weakening or bypassing of browser-based security mechanisms such as Content Security Policy or X-XSS-Protection. This vulnerability is fixed in 6.3.

HighVulnerabilityGermanyFranceUnited Kingdom+7#cve#cve-2025-59151#cwe-93

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interface versions 6.2.1 and earlier are vulnerable to reflected cross-site scripting (XSS) via a malformed URL path. The 404 error page includes the requested path in the class attribute of the body tag without proper sanitization or escaping. An attacker can craft a URL containing an onload attribute that will execute arbitrary JavaScript code in the browser when a victim visits the malicious link. If an attacker sends a crafted pi-hole link to a victim and the victim visits it, attacker-controlled JavaScript code is executed in the browser of the victim. This has been patched in version 6.3.

MediumVulnerabilityGermanyFranceUnited Kingdom+6#cve#cve-2025-53533#cwe-79