CVE-2025-32785 (CNNVD-202510-3497)
中文标题:
Pi-hole Web Interface 跨站脚本漏洞
英文标题:
Pi-hole Admin Interface vulnerable to persistent XSS on Subscribed lists group management (Adress Field)
漏洞描述
中文描述:
Pi-hole Web Interface是Pi-hole开源的一个仪表板Web界面。 Pi-hole Web Interface 6.3之前版本存在跨站脚本漏洞，该漏洞源于Address字段输入清理不当，可能导致跨站脚本攻击。
英文描述:
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interface versions prior to 6.3 are vulnerable to cross-site scripting (XSS) via the Address field in the Subscribed Lists group management section. An authenticated user can inject malicious JavaScript by adding a payload to the Address field when creating or editing a list entry. The vulnerability is triggered when another user navigates to the Tools section and performs a gravity database update. The Address field does not properly sanitize input, allowing special characters and script tags to bypass validation. This has been patched in version 6.3.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| pi-hole | web | < 6.3 | - | - |
cpe:2.3:a:pi-hole:web:<_6.3:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
参考链接
cve.org
CVSS评分详情
4.0 (cna)
LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-32785 |
2025-11-11 15:23:16 | 2025-11-11 07:40:24 |
| NVD | nvd_CVE-2025-32785 |
2025-11-11 15:01:07 | 2025-11-11 07:48:14 |
| CNNVD | cnnvd_CNNVD-202510-3497 |
2025-11-11 15:12:59 | 2025-11-11 08:00:19 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 跨站脚本
- cnnvd_id: 未提取 -> CNNVD-202510-3497
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- data_sources: ['cve'] -> ['cve', 'nvd']