CVE-2021-29448

8.8 highEPSS 0.7%

High (8.8) in pi-hole. EPSS 0.7% chance of exploitation in the next 30 days.

Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. The Stored XSS exists in the Pi-hole Admin portal, which can be exploited by the malicious actor with the network access to DNS server. See the referenced GitHub security advisory for patch details.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:H

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 51% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2021-04-15
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

pi-hole:ftldns
pi-hole:pi-hole
pi-hole:web_interface

References

https://github.com/pi-hole/AdminLTE/security/advisories/GHSA-cwwf-93p7-73j9
https://github.com/pi-hole/AdminLTE/security/advisories/GHSA-cwwf-93p7-73j9

Check your stack JSON