Pi-hole welcomes all responsible disclosures. Please do not open an ISSUE to report a security problem
We accept disclosures via email at disclosure@pi-hole.net.
Security: pi-hole/web
Security
SECURITY.md
-
Improper session handling of "Remember me for 7 days" functionalityGHSA-33w4-xf7m-f82m published
Jan 25, 2023 by PromoFauxHigh -
Broken Access Control in queryads endpointGHSA-6qh8-6rrj-7497 published
Dec 21, 2022 by PromoFauxLow -
Authenticated XSS in "scripts/pi-hole/php/queryads.php"GHSA-cfr5-rqm5-9vhp published
Jul 7, 2022 by rdwebdesignLow -
Stored XSS in Client Groups Management (Authenticated)GHSA-mhr8-7rvg-8r43 published
Oct 23, 2021 by PromoFauxLow -
Sensitive Cookie Without 'HttpOnly' Flag in pi-hole/adminlteGHSA-9hfp-j66v-6q3j published
Sep 17, 2021 by PromoFauxHigh -
Cross-site Scripting (XSS) - Reflected in pi-hole/adminlteGHSA-3gfp-33g5-4cqq published
Sep 17, 2021 by PromoFauxModerate -
Cross-site Scripting (XSS) - Reflected in pi-hole/adminlteGHSA-5q5w-qm5m-49qq published
Sep 17, 2021 by PromoFauxModerate -
Stored XSS Vulnerability in the Pi-hole WebinterfaceGHSA-g3w6-q4fg-p8x8 published
Aug 4, 2021 by PromoFauxModerate -
(Authenticated) Remote Code Execution Possible in Web Interface 5.5GHSA-5cm9-6p3m-v259 published
Aug 4, 2021 by PromoFauxHigh -
Stored DOM XSS in Pi-hole Admin Web Interface v5.4GHSA-cwwf-93p7-73j9 published
Apr 14, 2021 by PromoFauxModerate
Learn more about advisories related to pi-hole/web in the GitHub Advisory Database