CVE-2025-53533— Pi-hole Web Interface 跨站脚本漏洞
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2025-53533の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
Pi-hole Admin Interface vulnerable to cross-site scripting via malformed URL path on 404 error page
ソース: NVD (National Vulnerability Database)
脆弱性説明
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interface versions 6.2.1 and earlier are vulnerable to reflected cross-site scripting (XSS) via a malformed URL path. The 404 error page includes the requested path in the class attribute of the body tag without proper sanitization or escaping. An attacker can craft a URL containing an onload attribute that will execute arbitrary JavaScript code in the browser when a victim visits the malicious link. If an attacker sends a crafted pi-hole link to a victim and the victim visits it, attacker-controlled JavaScript code is executed in the browser of the victim. This has been patched in version 6.3.
ソース: NVD (National Vulnerability Database)
CVSS情報
N/A
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
ソース: NVD (National Vulnerability Database)
脆弱性タイトル
Pi-hole Web Interface 跨站脚本漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Pi-hole Web Interface是Pi-hole开源的一个仪表板Web界面。 Pi-hole Web Interface 6.2.1及之前版本存在跨站脚本漏洞，该漏洞源于404错误页面未正确清理或转义URL路径，可能导致反射型跨站脚本攻击。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
II. CVE-2025-53533の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|---|---|---|
| 1 | Cross-Site-Scripting XSS in Pi-hole-CVE-2025-53533 exploit (PoC) | https://github.com/moezbouzayani9/Pi-hole-XSS-CVE-2025-53533 | POC詳細 |
| 2 | Pi-hole Admin Interface <= 6.2.1 contains a reflected XSS vulnerability on the 404 error page. The URL path is reflected unsanitized into the `class` attribute of the `body` tag, allowing attribute injection via a crafted URL to execute arbitrary JavaScript in victim browsers. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-53533.yaml | POC詳細 |
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2025-53533のインテリジェンス情報
请登录查看更多情报信息。
Same Patch Batch · pi-hole · 2025-10-27 · 3 CVEs total
| CVE-2025-59151 | 8.2 HIGH | Pi-hole Admin Interface vulnerable to HTTP response header injection via CRLF injection |
| CVE-2025-32785 | Pi-hole Admin Interface vulnerable to persistent XSS on Subscribed lists group management |
IV. 関連脆弱性
同じ製品: web
- CVE-2026-33405
Pi-hole has a Stored HTML Injection in queries.js - CVE-2026-33406
Pi-hole has a Stored HTML attribute injection - CVE-2026-33404
Pi-hole has a Stored XSS / HTML injection in the Network pag - CVE-2026-33403
Pi-hole has a Reflected XSS / HTML injection in taillog.js - CVE-2026-33765
Pi-hole Web Interface has a Command Injection Vulnerability
同じベンダー: pi-hole
- CVE-2026-39849
Pi-hole FTL remote code execution via newline injection in d - CVE-2026-35521
Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp - CVE-2026-35520
Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp - CVE-2026-35519
Pi-hole FTL affected by Remote Code Execution (RCE) via dns. - CVE-2026-35518
Pi-hole FTL affected by Remote Code Execution (RCE) via dns.
同じ弱点: CWE-79
- CVE-2026-8262
Devs Palace ERP Online chart-save cross site scripting - CVE-2026-8256
Devs Palace ERP Online mr-save cross site scripting - CVE-2026-8255
Devs Palace ERP Online add_new_customer cross site scripting - CVE-2026-8254
Devs Palace ERP Online sales_save cross site scripting - CVE-2026-8253
Devs Palace ERP Online purchase_save cross site scripting
V. CVE-2025-53533へのコメント
まだコメントはありません