| Package | Affected versions | Patched versions |
|---|---|---|
| pi-hole | < 5.2.2 | 5.2.2 |
The DNS query log in Pi-hole before 5.2.2 is vulnerable to stored XSS. An attacker with the ability to directly or indirectly query DNS with a malicious hostname can cause arbitrary JavaScript to execute when the Pi-hole administrator visits the Query Log or Long-term data Query Log page.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free