CVE-2025-32785
- Published: 1761592563
- Last modified: 1761592563
CVE-2025-32785 — Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interface versions prior to 6.3 are vulnerable to cross-site scripting (XSS) via the Address field in the Subscribed Lists group management section. An authenticated user can inject malicious JavaScript by…
Related CVE by CWE
No related CWE found.
Top CVE for Vendor
No vendor taxonomy on this entry.
Recently Exploited Similar Vulnerabilities
No recent KEV-listed items for this vendor/product.
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interface versions prior to 6.3 are vulnerable to cross-site scripting (XSS) via the Address field in the Subscribed Lists group management section. An authenticated user can inject malicious JavaScript by adding a payload to the Address field when creating or editing a list entry. The vulnerability is triggered when another user navigates to the Tools section and performs a gravity database update. The Address field does not properly sanitize input, allowing special characters and script tags to bypass validation. This has been patched in version 6.3.
🧠 Explainer: What this vulnerability means
Summary: This vulnerability affects the product by the vendor (CWE: unspecified).
Impact: Attackers could gain unauthorized access, execute code, or disrupt services.
Mitigation: Apply the latest vendor patch or update to a fixed version; disable vulnerable modules where possible.
No vendor/product data yet.
No explicit mitigation/advisory links found in references.