Description
Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. From 2024-06-29 to before 2026-05-07, the web application endpoint is vulnerable to SQL injection. The /pialert/php/server/devices.php route accepts requests from unauthenticated users when the action URL parameter is set to getDevicesTotals. The scansource URL parameter is then injected in a SQL query. This vulnerability is fixed in 2026-05-07.
Published: 2026-05-27
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Pi.Alert web interface processes the scansource parameter without adequate validation, enabling unauthenticated blind SQL injection via the devices.php endpoint. This flaw falls under CWE-89 and could allow attackers to retrieve or alter database contents, compromising confidentiality and integrity of network device data.

Affected Systems

Pi.Alert, developed by leiweibau, all releases prior to and including 2026-05-07 are affected. The vulnerability exists from 2024-06-29 until the patch released on 2026-05-07.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity. EPSS is not available, so we cannot quantify the current exploitation probability, and the vulnerability is not catalogued in CISA KEV. Based on the description, the likely attack vector is an unauthenticated HTTP request to /pialert/php/server/devices.php with the action set to getDevicesTotals and a crafted scansource value. An attacker with network access can exploit this flaw remotely to query the database and extract or modify sensitive data.

Generated by OpenCVE AI on May 27, 2026 at 20:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Pi.Alert patch released on 2026-05-07 to eliminate the injection flaw.
  • If the patch cannot be applied immediately, block unauthenticated access to /pialert/php/server/devices.php using network controls or firewall rules.
  • Monitor web server logs for repeated requests containing the scansource parameter and other suspicious activity.
  • Consider disabling the devices.php endpoint if it is not required for your deployment, or implement application-layer authorization to restrict access to trusted users.

Generated by OpenCVE AI on May 27, 2026 at 20:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 29 May 2026 16:00:00 +0000

Type Values Removed Values Added
First Time appeared Leiweibau
Leiweibau pi.alert
Vendors & Products Leiweibau
Leiweibau pi.alert

Thu, 28 May 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 27 May 2026 19:30:00 +0000

Type Values Removed Values Added
Description Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. From 2024-06-29 to before 2026-05-07, the web application endpoint is vulnerable to SQL injection. The /pialert/php/server/devices.php route accepts requests from unauthenticated users when the action URL parameter is set to getDevicesTotals. The scansource URL parameter is then injected in a SQL query. This vulnerability is fixed in 2026-05-07.
Title Pi.Alert: Web Interface Vulnerable to Unauthenticated Blind SQL Injection
Weaknesses CWE-89
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Leiweibau Pi.alert
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-05-28T13:49:07.413Z

Reserved: 2026-05-07T21:50:33.545Z

Link: CVE-2026-44886

cve-icon Vulnrichment

Updated: 2026-05-28T13:48:55.682Z

cve-icon NVD

Status : Deferred

Published: 2026-05-27T20:16:37.767

Modified: 2026-06-17T10:51:29.083

Link: CVE-2026-44886

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-29T15:50:17Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')