CVE-2020-14971

Pi-hole through 5.0 allows code injection in piholedhcp (the Static DHCP Leases section) by modifying Teleporter backup files and then restoring them. This occurs in settings.php. To exploit this, an attacker would request a backup of limited files via teleporter.php. These are placed into a .tar.gz archive. The attacker then modifies the host parameter in dnsmasq.d files, and then compresses and uploads these files again.

• CWE-862

• https://blog.telspace.co.za/2020/06/pi-hole-code-injection-cve-2020-14971.htmlThird Party Advisory
• https://github.com/pi-hole/AdminLTE/commit/8f6e1365b6dec0ae1aa0b0b15b102c9133f347e5Patch, Third Party Advisory
• https://github.com/pi-hole/AdminLTE/commit/c949516ee15fa6a9b0c8511cc4c4d6b0893f3e69Patch, Third Party Advisory
• https://github.com/pi-hole/AdminLTE/pull/1443Third Party Advisory
• https://blog.telspace.co.za/2020/06/pi-hole-code-injection-cve-2020-14971.htmlThird Party Advisory
• https://github.com/pi-hole/AdminLTE/commit/8f6e1365b6dec0ae1aa0b0b15b102c9133f347e5Patch, Third Party Advisory
• https://github.com/pi-hole/AdminLTE/commit/c949516ee15fa6a9b0c8511cc4c4d6b0893f3e69Patch, Third Party Advisory
• https://github.com/pi-hole/AdminLTE/pull/1443Third Party Advisory

Published

Jun 23, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-14965On TP-Link TL-WR740N v4 and TL-WR740ND v4 devices, an attack…4.8
• CVE-2020-14966An issue was discovered in the jsrsasign package through 8.0…7.5
• CVE-2020-14967An issue was discovered in the jsrsasign package before 8.0.…9.8
• CVE-2020-14968An issue was discovered in the jsrsasign package before 8.0.…9.8
• CVE-2020-14969app/Model/Attribute.php in MISP 2.4.127 lacks an ACL lookup …7.5
• CVE-2020-1497An information disclosure vulnerability exists when Microsof…5.5
• CVE-2020-14972Multiple SQL injection vulnerabilities in Sourcecodester Pis…9.8
• CVE-2020-14973The loginForm within the general/login.php webpage in webTar…6.1
• CVE-2020-14974The driver in IOBit Unlocker 1.1.2 allows a low-privileged u…7.1
• CVE-2020-14975The driver in IOBit Unlocker 1.1.2 allows a low-privileged u…7.8
• CVE-2020-14976GNS3 ubridge through 0.9.18 on macOS, as used in GNS3 server…5.5
• CVE-2020-14977An issue was discovered in F-Secure SAFE 17.7 on macOS. The …8.1