The Pi‑hole Admin Interface allows hostnames and IP addresses entered through DHCP or DNS to be displayed on the Network page and Dashboard without proper escaping. As a result, an attacker can embed malicious script or HTML fragments in those values, which the browser will execute when any user views the affected pages, enabling credential theft, defacement, or further compromise within the admin session.

Versions of Pi‑hole from 6.0 up to, but not including, 6.5 are affected. The vulnerability resides in the web interface component that renders the FTL database entries for network hosts.

The CVSS score of 3.4 indicates moderate impact. No publicly available exploit or widespread attacks are documented. Attackers would need to insert malicious hostnames or IP addresses into the network database, typically achievable by controlling the local DHCP/DNS infrastructure. If the admin interface is reachable from the broader internet, the exposure increases, but the risk remains moderate unless accessed by untrusted users.