Product by Pi-hole
AdminLTE
16 known vulnerabilities in AdminLTE (Pi-hole), 0 of them actively exploited (CISA KEV).
Key figures
16
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-33765 | Pi-hole Web Interface has a Command Injection Vulnerability | 9.8 | |
| High | CVE-2023-23614 | Improper session handling of "Remember me for 7 days" functionality | 8.8 | |
| High | CVE-2021-3706 | Sensitive Cookie Without 'HttpOnly' Flag in pi-hole/adminlte | 7.4 | |
| High | CVE-2021-41175 | Stored XSS in Client Groups Management (Authenticated) | 7.3 | |
| High | CVE-2025-59151 | Pi-hole Admin Interface vulnerable to HTTP response header injection via CRLF injection | 8.2 | |
| Medium | CVE-2025-53533 | Pi-hole Admin Interface vulnerable to cross-site scripting via malformed URL path on 404 error page | 6.1 | |
| High | CVE-2021-29448 | Stored DOM XSS in Pi-hole Admin Web Interface | 7.6 | |
| Medium | CVE-2021-3812 | Cross-site Scripting (XSS) - Reflected in pi-hole/adminlte | 6.7 | |
| Medium | CVE-2021-3811 | Cross-site Scripting (XSS) - Reflected in pi-hole/adminlte | 6.7 | |
| Medium | CVE-2026-33406 | Pi-hole has a Stored HTML attribute injection | 6.1 | |
| Medium | CVE-2026-26953 | Pi-hole Web Interface has Stored HTML Injection via X-Forwarded-For Header in Active Sessions Table | 5.4 | |
| Medium | CVE-2026-33403 | Pi-hole has a Reflected XSS / HTML injection in taillog.js | 6.1 | |
| Medium | CVE-2026-33404 | Pi-hole has a Stored XSS / HTML injection in the Network page/Dashboard | 6.1 | |
| Medium | CVE-2026-26952 | Pi-hole Web: Cross-site Scripting | 5.4 | |
| Medium | CVE-2025-32785 | Pi-hole Web: Cross-site Scripting | 5.4 | |
| Medium | CVE-2026-33405 | Pi-hole has a Stored HTML Injection in queries.js | 4.8 |