CVE-2021-29448

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. The Stored XSS exists in the Pi-hole Admin portal, which can be exploited by the malicious actor with the network access to DNS server. See the referenced GitHub security advisory for patch details.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:H

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
pi-holeAdminLTE<= 5.4

References

Timeline

Published
Apr 15, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-294497.8Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Multiple privilege escalation vulnerabilities wereCVE-2021-294504.3Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts aCVE-2021-294519.1Portofino is an open source web development framework. Portofino before version 5.2.1 did not properly verify the signature of JSON Web TokeCVE-2021-294526.5a12n-server is an npm package which aims to provide a simple authentication system. A new HAL-Form was added to allow editing users in versiCVE-2021-294536.5matrix-media-repo is an open-source multi-domain media repository for Matrix. Versions 1.2.6 and earlier of matrix-media-repo do not properlCVE-2021-294548.8Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.42CVE-2021-294555.3Grassroot Platform is an application to make it faster, cheaper and easier to persistently organize and mobilize people in low-income communCVE-2021-294565.4Authelia is an open-source authentication and authorization server providing 2-factor authentication and single sign-on (SSO) for your appliCVE-2021-294577.8Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A heap buffer oveCVE-2021-294585.5Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds CVE-2021-294596.1XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible to persistently injeCVE-2021-294605.4Kirby is an open source CMS. An editor with write access to the Kirby Panel can upload an SVG file that contains harmful content like `<scri