CVE-2025-59151

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interface before 6.3 is vulnerable to Carriage Return Line Feed (CRLF) injection. When a request is made to a file ending with the .lp extension, the application performs a redirect without properly sanitizing the input. An attacker can inject carriage return and line feed characters (%0d%0a) to manipulate both the headers and the content of the HTTP response. This enables the injection of arbitrary HTTP response headers, potentially leading to session fixation, cache poisoning, and the weakening or bypassing of browser-based security mechanisms such as Content Security Policy or X-XSS-Protection. This vulnerability is fixed in 6.3.

• CWE-93
• CWE-113

• https://github.com/pi-hole/web/security/advisories/GHSA-5v79-p56f-x7c4Exploit, Vendor Advisory

Published

Oct 27, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-59146New API is a large language mode (LLM) gateway and artificia…8.5
• CVE-2025-59147Suricata is a network IDS, IPS and NSM engine developed by t…7.5
• CVE-2025-59148Suricata is a network IDS, IPS and NSM engine developed by t…7.5
• CVE-2025-59149Suricata is a network IDS, IPS and NSM engine developed by t…6.2
• CVE-2025-5915A vulnerability has been identified in the libarchive librar…6.6
• CVE-2025-59150Suricata is a network IDS, IPS and NSM engine developed by t…7.5
• CVE-2025-59152Litestar is an Asynchronous Server Gateway Interface (ASGI) …7.5
• CVE-2025-59154Openfire is an XMPP server licensed under the Open Source Ap…5.9
• CVE-2025-59155hackmd-mcp is a Model Context Protocol server for integratin…6.9
• CVE-2025-59156Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2025-59157Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2025-59158Coolify is an open-source and self-hostable tool for managin…8