CVE-2025-53533: Pi-hole Admin Interface vulnerable to cross-site scripting via malformed URL path on 404 error page
pi-hole · web
Affected: pi-hole web · Exploitation: check available, not yet exploited
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 48% of scored CVEs
DescriptionCVE.org
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interface versions 6.2.1 and earlier are vulnerable to reflected cross-site scripting (XSS) via a malformed URL path. The 404 error page includes the requested path in the class attribute of the body tag without proper sanitization or escaping. An attacker can craft a URL containing an onload attribute that will execute arbitrary JavaScript code in the browser when a victim visits the malicious link. If an attacker sends a crafted pi-hole link to a victim and the victim visits it, attacker-controlled JavaScript code is executed in the browser of the victim. This has been patched in version 6.3.
Affected products1
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- pi-hole · web< 6.3
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Check available, not yet exploited. A public nuclei template can confirm it on a system you are authorised to test.
- CISA KEV
- Not listed
- Public check
- Pi-hole Reflected XSS in 404-Error Page · nuclei template in projectdiscovery/nuclei-templates
- Weakness
- Cross-site Scripting
- Vendor
- pi-hole
- Published
- October 2025
CoverageNo articles yet
No CyberSIXT article names CVE-2025-53533 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.