CVE-2026-33403: Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, a…

PriorityP430medium6.1CVSS 3.1

AVNACLPRNUIRSCCLILAN

EPSS

0.19%

8.5th percentile

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, a reflected DOM-based XSS vulnerability in taillog.js allows an unauthenticated attacker to inject arbitrary HTML into the Pi-hole admin interface by crafting a malicious URL. The file query parameter is interpolated into an innerHTML assignment without escaping. Because the Content-Security-Policy is missing the form-action directive, injected elements can exfiltrate credentials to an external origin. This vulnerability is fixed in 6.5.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
pi-hole	web	—	—
pi-hole	web_interface	6.0 – 6.4.1	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.