CVE-2020-11108: pi-hole

EPSS trend

Probability

78.26%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 78.26% on 21-09-2026

21-09-202621-10-2026

EPSS score

78.26%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

9 found

githubUnverified
Cve 2020 11108 Poc
Maturity: poc
referenceUnverified
Exploit Reference (frichetten.com)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown

Show all 9 exploits

referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
exploit-databaselinuxVerified
Pi-hole 4.4.0 - Remote Code Execution (Authenticated)
Maturity: poc
exploit-databaselinuxUnverified
Pi-hole < 4.4 - Authenticated Remote Code Execution
Maturity: poc
exploit-databaselinuxUnverified
Pi-hole < 4.4 - Authenticated Remote Code Execution / Privileges Escalation
Maturity: poc
exploit-databaseremotephpVerified
Pi-Hole - heisenbergCompensator Blocklist OS Command Execution (Metasploit)
Maturity: weaponized
MetasploitremoteVerified
Pi-Hole heisenbergCompensator Blocklist OS Command Execution
exploit/unix/http/pihole_blocklist_exec
Maturity: weaponized

References

6 links

frichetten.com/blog/cve-2020-11108-pihole-rce/X Refsource MISCExploitThird Party Advisory
github.com/Frichetten/CVE-2020-11108-PoCX Refsource MISCExploitThird Party Advisory
packetstormsecurity.com/files/157623/Pi-hole-4.4-Remote-Code-Execution.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
packetstormsecurity.com/files/157624/Pi-hole-4.4-Remote-Code-Execution-Privilege-Escalation.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
packetstormsecurity.com/files/…X Refsource MISC
packetstormsecurity.com/files/157839/Pi-hole-4.4.0-Remote-Code-Execution.htmlX Refsource MISC

Related vulnerabilities

CVE-2021-29448pi-holeadminlte+30.67%5y ago15-04-2021 15:25Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. The Stored XSS exists in the Pi-hole Admin portal, which can be exploited by the malicious actor with the network access to DNS server. See the referenced GitHub security advisory for patch details.CVE-2021-29449pi-holepi-hole1.85%5y ago14-04-2021 22:05Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Multiple privilege escalation vulnerabilities were discovered in version 5.2.4 of Pi-hole core. See the referenced GitHub security advisory for details.CVE-2021-32793pi-holeadminlte+10.79%5y ago04-08-2021 17:55Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5.1, the function to add domains to blocklists or allowlists is vulnerable to a stored cross-site-scripting vulnerability. User input added as a wildcard domain to a blocklist or allowlist is unfiltered in the web interface. Since the payload is stored permanently as a wildcard domain, this is a persistent XSS vulnerability. A remote attacker can therefore attack administrative user accounts through client-side attacks. Pi-hole Web Interface version 5.5.1 contains a patch for this vulnerability.CVE-2021-32706pi-holeadminlte+160.18%5y ago04-08-2021 17:50Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5.1, the `validDomainWildcard` preg_match filter allows a malicious character through that can be used to execute code, list directories, and overwrite sensitive files. The issue lies in the fact that one of the periods is not escaped, allowing any character to be used in its place. A patch for this vulnerability was released in version 5.5.1.CVE-2025-34087pi-hole llcweb+16.88%1y ago03-07-2025 19:46An authenticated command injection vulnerability exists in Pi-hole versions up to 3.3. When adding a domain to the allowlist via the web interface, the domain parameter is not properly sanitized, allowing an attacker to append OS commands to the domain string. These commands are executed on the underlying operating system with the privileges of the Pi-hole service user. This behavior was present in the legacy AdminLTE interface and has since been patched in later versions.CVE-2020-14162pi-holepi-hole0.59%6y ago30-07-2020 13:05An issue was discovered in Pi-Hole through 5.0. The local www-data user has sudo privileges to execute the pihole core script as root without a password, which could allow an attacker to obtain root access via shell metacharacters to this script's setdns command.

All vulnerabilities inpi-hole

CVE-2020-11108: pi-hole

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References