CVE-2026-33405lowCWE-79

CVE-2026-33405: falha de baixa gravidade em pi-hole web

Pi-hole has a Stored HTML Injection in queries.js

Publicada em

Seguir esta CVE+ Monitorar web

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 3.1epss 0.2%
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, the formatInfo() function in queries.js renders data.upstream, data.client.ip, and data.ede.text into HTML without escaping when a user expands a query row in the Query Log, enabling stored HTML injection. JavaScript execution is blocked by the server's CSP (script-src 'self'). The same fields are properly escaped in the table view (rowCallback), confirming the omission was an oversight. This vulnerability is fixed in 6.5.
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Produtos afetados
pi-hole · web
CVEs relacionadas — pi-hole web

No mesmo produto, das mais perigosas para as menos.

CVE-2026-33765HIGHPi-hole Web Interface has a Command Injection VulnerabilityEPSS 1.3%CVE-2025-53533MEDIUMPi-hole Admin Interface vulnerable to cross-site scripting via malformed URL path on 404 error pageEPSS 0.6%CVE-2025-59151HIGHPi-hole Admin Interface vulnerable to HTTP response header injection via CRLF injectionEPSS 0.4%CVE-2026-26953MEDIUMPi-hole Web Interface has Stored HTML Injection via X-Forwarded-For Header in Active Sessions TableEPSS 0.3%CVE-2026-26952MEDIUMPi-hole Web Interface has Stored HTML Injection via Local DNS Records (CNAME/Hosts) in data-tag AttributeEPSS 0.3%CVE-2026-33406MEDIUMPi-hole has a Stored HTML attribute injectionEPSS 0.3%